CVE-2026-59094 Details

A denial-of-service vulnerability has been identified in the Pathway document store application, specifically in versions through 0.31.1. The issue arises from the application of user-supplied glob patterns to indexed document paths using a custom recursive matcher. This matcher, which lacks memoization, creates an exponential worst-case complexity by branching in two directions for each '**' token. The vulnerable glob pattern matching is exposed through the unauthenticated HTTP endpoints '/v1/retrieve', '/v1/inputs', and '/v2/answer'. A remote attacker can exploit this vulnerability by sending a short pattern with multiple '**' tokens, causing significant CPU consumption for each affected indexed document, and leading to a denial-of-service condition.

Users are advised to update to Pathway version 0.31.1 or later, where this vulnerability has been fixed. The fix involves optimizing the glob pattern matching to use a polynomial algorithm instead of an exponential one, and adding memoization to the matching process.