Executive brief
Pathway, a data processing framework used for building AI and RAG applications, contains a flaw in how it handles document search queries. An unauthenticated remote attacker can send a specially crafted search request that forces the server to perform extremely complex calculations, consuming all available CPU resources. This can lead to a total denial of service, making the document store and search features unavailable to legitimate users.
Technical details
A Denial of Service (DoS) vulnerability exists in Pathway's document store due to inefficient algorithmic complexity (CWE-407) in the `_globmatch_impl` function. The hand-written recursive matcher branches two ways for every '**' token without memoization, resulting in O(2^k) exponential time complexity. An unauthenticated remote attacker can exploit this by submitting a short glob pattern with multiple '**' segments to the `/v1/retrieve`, `/v1/inputs`, or `/v2/answer` HTTP endpoints. This causes the server to exhaust CPU resources for extended periods while evaluating the pattern against indexed documents. The issue is fixed in commit d09722e by implementing dynamic programming (memoization) to reduce complexity to polynomial time.
Affected products
- pathwaycom Pathway 0.31.1 and earlier
Timeline
- 2026-06-12: disclosed: Issue reported on GitHub
- 2026-07-02: patched: Fix merged in commit d09722e
- 2026-07-02: advisory
References
- https://github.com/pathwaycom/pathway/commit/d09722eef03fd94bba701836eb4c7fbfa3d3b88e
- https://github.com/pathwaycom/pathway/issues/241
- https://github.com/pathwaycom/pathway/pull/250
- https://www.vulncheck.com/advisories/pathway-unauthenticated-denial-of-service-via-exponential-glob-pattern-matching-in-document-store