CVE-2022-3517: Debian Linux

High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days.

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

Affected products

• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 36 only; version 37 only
• Minimatch Project Minimatch: before 3.0.5 (fixed in 3.0.5)

Published 2022-10-17. Last modified 2026-06-17.