CVE-2010-4052: Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.

CSIRTS triage

vendor: GNU product: glibc Denial of serviceaffected: 2.11.3 and prior, 2.12.x through 2.12.2

What: Stack consumption vulnerability in regcomp allows denial of service via regular expressions with adjacent repetitions.
Who is affected: Applications using glibc regex functions on affected glibc versions.
Urgency: Moderate; exploitation requires specific malicious regex patterns but causes resource exhaustion.
Action: Upgrade glibc to version 2.13 or later.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch glibc

Get an email when a new glibc advisory drops — max one per day, one-click unsubscribe.

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Exploitation likely imminentCVE-2010-4052EPSS puts this in the most-targeted tier (51.3% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 99% of all EPSS-scored CVEs.

CVE	CSIRTS overview	External
CVE-2010-4052	coverage & exploitation status	NVD · CVE.org