HCL Hive Regex Library DoS Vulnerabilities and Patch Guide (CVE-2026-33750/26996/27904)

Vulnerability Overview HCL Hive contains multiple security vulnerabilities, specifically: 1. CVE-ID: CVE-2026-33750 - Description: The regex library generates arbitrary strings containing common prefixes and suffixes. In versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, bracket patterns with zero step values (e.g., ) cause the sequence generation loop to run infinitely, causing the process to hang for several seconds and allocate significant memory. - CVSS Score: 6.5 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 2. CVE-ID: CVE-2026-26996 - Description: is a minimal matching utility for converting glob expressions into JavaScript RegEx objects. In versions 10.2.0 and below, it is vulnerable to Regular Expression Denial of Service (ReDoS) when the glob pattern contains consecutive wildcards followed by a literal character not present in the test string. For example, compiles into separate regex groups, and when matching fails, the V8 engine backtracks across all possible paths. The time complexity is O(N!), where N is the number of characters. For N=15, a single call takes approximately 2 seconds; for N=34, it hangs indefinitely. Any application calling with user-controlled strings is susceptible to DoS attacks. This issue has been fixed in version 10.2.1. - CVSS Score: 7.5 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 3. CVE-ID: CVE-2026-27904 - Description: is a minimal matching utility for converting glob expressions into JavaScript RegEx objects. In versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.5, 5.1.8, 4.2.5, and 3.1.4, causes catastrophic backtracking in V8 when provided with "N" nested "" wildcards, "N" nested "{...}" wildcards, and 18 bytes of non-matching input. Adding a single nesting level or a few input characters pushes the execution time to several minutes. This is the most severe finding. It is triggered via the default API without special options, requiring a minimum input of only 12 bytes. The same issue affects the utility. This problem has been fixed in versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.5, 5.1.8, 4.2.5, and 3.1.4. - CVSS Score: 7.5 Affected Scope CVE-2026-33750: Affects versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13. CVE-2026-26996: Affects versions 10.2.0 and below. CVE-2026-27904: Affects versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.5, 5.1.8, 4.2.5, and 3.1.4. Remediation CVE-2026-33750: Use to ensure the step value is not 0. CVE-2026-26996: Upgrade to version 10.2.1 or later. CVE-2026-27904**: Upgrade to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.5, 5.1.8, 4.2.5, and 3.1.4 or later. POC Code No specific POC code was provided in the source document.

Goal Reached Thanks to every supporter — we hit 100%!

HCL Hive Regex Library DoS Vulnerabilities and Patch Guide (CVE-2026-33750/26996/27904)