The vulnerability of the library for filtering file paths in Picomatch, which stems from the use of a regular expression c with inefficient computational complexity, allows attackers to trigger a service failure.

🗓️ 08 Jul 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

Picomatch file path filter library vulnerability uses inefficient regex, enabling remote attacker to cause outages.

Reporter	Title	Published	Views	Family All 81
IBM Security Bulletins	Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty	28 Apr 202613:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Automation Decision Services for June 2026- Multiple CVEs addressed	14 Jul 202606:59	–	ibm
IBM Security Bulletins	Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	5 May 202614:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WinCollect Agent is vulnerable to using components with known vulnerabilities	6 Jul 202613:49	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i (CVE-2026-3505, CVE-2025-14813, CVE-2026-0636, CVE-2026-5598, CVE-2026-33671, CVE-2026-33672, CVE-2026-5588, CVE-2026-40175)	8 Jun 202613:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge	8 Jul 202608:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerabilities in picomatch-2.3.1.tgz	7 May 202619:16	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by vulnerabilities in Picomatch (CVE-2026-33671, CVE-2026-33672)	12 May 202618:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.	3 Jun 202607:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses picomatch-2.3.1.tgz which is vulnerable to CVE-2026-33671, CVE-2026-33672.	4 May 202606:54	–	ibm

Vulners

Node

OR

red_hat jboss_enterprise_application_platformMatch7

red_hat openshift_container_platformMatch4

red_hat red_hat_amq_brokerMatch7

red_hat data_gridMatch8

red_hat red_hat_3scale_api_management_platformMatch2

red_hat red_hat_openshift_dataMatch4

red_hat red_hat_satelliteMatch6

red_hat red_hat_build_of_optaplannerMatch8

red_hat red_hat_fuseMatch7

red_hat red_hat_build_of_apicurio_registryMatch2

red_hat cryostatMatch4

red_hat ansible_automation_platformMatch2

red_hat migration_toolkit_for_applicationsMatch8

red_hat jboss_enterprise_application_platformMatch8

red_hat red_hat_enterprise_linuxMatch8

red_hat red_hat_enterprise_linuxMatch9

red_hat red_hat_enterprise_linuxMatch10

Source	Link
github	www.github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d
github	www.github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj
lk	www.lk.astralinux.ru/
access	www.access.redhat.com/security/cve/cve-2026-33671
web	www.web.nvd.nist.gov/view/vuln/detail

23 Jul 2026 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 37.5

CVSS 27.8

EPSS0.00412

Picomatch file paths regular expression inefficient complexity remote attacker service outages