PT-2026-47240 · Unknown · Tiny-Regex-C

Fantasy · CVE-2026-11478 · Published 2026-06-08 · Updated 2026-06-08

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions kokke tiny-regex-c versions prior to f2632c6d9ed25272987471cdb8b70395c2460bdb

Description A flaw in the Pattern Handler component affects the matchstar() function within the re.c file. This issue allows for inefficient regular expression complexity, which can be triggered via local execution.

Recommendations As a temporary workaround, restrict the use of the matchstar() function until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

DoS

Weakness Enumeration

CWE-400

CWE-1333

Related Identifiers

CVE-2026-11478

Affected Products

Tiny-Regex-C

References · 12

• 🔥❌ https://github.com/user-attachments/files/28046213/tiny-regex-c-redos-poc.zip · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2026-11478 · Security Note
• https://github.com/kokke/tiny-regex-c/issues/100 · Note
• https://vuldb.com/submit/833966 · Note
• https://vuldb.com/vuln/369098 · Note
• https://t.me/CVEtracker/56122 · Telegram Post
• https://twitter.com/threatcluster/status/2063924161592926553 · Twitter Post
• https://twitter.com/CVEnew/status/2063958202841010576 · Twitter Post
• https://github.com/kokke/tiny-regex-c · Note
• https://vuldb.com/cve/CVE-2026-11478 · Note
• https://vuldb.com/vuln/369098/cti · Note
• https://t.me/cveNotify/166448 · Telegram Post