VYPR
← All advisories
Unrated severityNVD Advisory· Published Mar 2, 2011· Updated Apr 29, 2026

CVE-2010-4756

CVE-2010-4756

Description

The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

glibc's glob() can exhaust CPU/memory via crafted unmatched patterns; FTP servers passing unsanitized globs remotely trigger DoS.

Vulnerability

The glob implementation in the GNU C Library (glibc) processes pathname expansion patterns without resource limits [1], [2]. Crafted glob expressions that do not match any pathnames can cause excessive CPU and memory consumption. Affected versions include glibc from before the introduction of GLOB_LIMIT flags (as found on some BSD systems) [1]. The official glibc maintainer views this as a design choice following POSIX, placing the responsibility on calling applications [1].

Exploitation

A remote authenticated user on an FTP server can send crafted STAT commands that contain glob expressions known to cause exponential backtracking or unbounded memory allocation [1]. The attack requires network access to a service that passes user-supplied strings unsanitized into the glob() function without setting process resource limits [1]. No other special privileges or race conditions are needed.

Impact

Successful exploitation results in denial of service (DoS) through high CPU usage and memory exhaustion, starving the affected system of resources for legitimate connections [1], [2]. The impact is limited to availability; no data confidentiality or integrity compromise is expected from this specific glibc behavior.

Mitigation

No official patch was released for glibc itself; the maintainers consider this a failure in the calling application [1], [2]. Network-facing services (e.g., FTP daemons) should either sanitize user-supplied glob patterns or enforce per-process resource limits (e.g., ulimit, memory rlimits) to prevent resource exhaustion [1]. Some BSD-derived systems offer a GLOB_LIMIT flag that glibc might adopt in the future [1].

References
  1. glob implementation can cause excessive CPU and memory consumption due to crafted glob expressions
  2. glob implementation can cause excessive CPU and memory consumption due to crafted glob expressions

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

459

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.