CVE-2010-4052: glibc regcomp stack exhaustion via adjacent repetition operators

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

medium priorityNetwork-reachable denial of service with public exploit code and high EPSS, but only availability impact and no KEV listing.

What it is

The regcomp implementation in GNU C Library (glibc) through 2.11.3 and 2.12.x through 2.12.2 consumes excessive stack when compiling a regular expression containing adjacent repetition operators, such as {10,}{10,}{10,}{10,}. A context-dependent attacker can trigger resource exhaustion and crash processes that compile attacker-influenced regexes, as demonstrated against ProFTPD.

Impact

An attacker can cause a denial of service by exhausting stack in the process that compiles the crafted regular expression, crashing or hanging that service. There is no confidentiality or integrity impact per the CVSS vector.

Attack surface

Reached over the network (AV:N) with no authentication (Au:N) and no user interaction, but only where an application passes attacker-controlled input into regcomp, such as a regex-based configuration or matching feature. The flaw is in the regex compiler, not in glibc's network stack itself.

Exploitation

Public exploit code exists, including the proftpd.gnu.c exploit and multiple Exploit-tagged references, and EPSS is high at roughly 0.51 (98.9th percentile), though the CVE is not listed in CISA KEV.

What to do

• Upgrade glibc to a version newer than 2.11.3 / 2.12.2 that contains the regcomp fix, then restart affected services.
• Where glibc cannot be updated immediately, avoid passing untrusted input into regcomp; validate or reject regexes containing adjacent repetition operators.
• Apply vendor patches for downstream applications such as ProFTPD that expose regex compilation to remote input.
• Limit exposure of services that compile user-supplied regexes and monitor them for repeated crashes or restarts.

Detection

• Monitor for abnormal process crashes, restarts or stack-exhaustion signals in services that compile regular expressions, especially ProFTPD.
• Alert on regex input containing repeated adjacent repetition operators such as {10,}{10,} in request or configuration logs.
• Track glibc versions across hosts and flag systems still running 2.11.3 or 2.12.x through 2.12.2.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.