CVE-2026-4926 — path-to-regexp vulnerable to Denial of Service via sequential optional groups

2026-10-04T14:37:57.580532+00:00

Affected: path-to-regexp, Red Hat Cryostat 4 on RHEL 9, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Migration Toolkit for Virtualization 2.1, Red Hat Migration Toolkit for Virtualization 2.9, Red Hat Ansible Automation Platform 2.6, Red Hat Developer Hub 1.8, Red Hat Developer Hub 1.9 and 42 more

Impact:

A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service.

Patches:

Fixed in version 8.4.0.

Workarounds:

Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.

Most recent entries from all

CVE-2026-4926 — path-to-regexp vulnerable to Denial of Service via sequential optional groups