CVE-2010-4052
MediumPublic exploitStack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent…
Published Jan 13, 2011 · Updated Aug 10, 2026 · Also known as DEBIAN-CVE-2010-4052
Key Facts
Patch immediately- CVE-2010-4052 is a medium-severity vulnerability (CVSS 5.0 v2) affecting Glibc (Gnu), Azl3 Augeas 1.12.0-6 (Microsoft), Azl3 Smartmontools 7.4-1 (Microsoft) and 1 more product.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 51% probability of exploitation in the next 30 days.
- Fixed versions are available, including Glibc 2.19-4, rootio-glibc 2.19-4.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
5.0
AV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS (30-day exploit likelihood)
51%
Higher than 98.9% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2010-4052 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.
Affected Products
44 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| GlibcGnu | 1.00, 1.01, 1.02, 1.03, 1.04, 1.05, 1.06, 1.07 | 2.19-4 |
| Azl3 Augeas 1.12.0-6Microsoft | See advisory | n/a |
| Azl3 Smartmontools 7.4-1Microsoft | See advisory | n/a |
| rootio-glibcrootio | See advisory | 2.19-4 |
Patched Releases
Glibc
2.19-4
rootio-glibc
2.19-4
Timeline
Publicly disclosed
Jan 13, 2011
Last updated
Aug 10, 2026
Weakness Type
- CWE-399
References
- advisory42547
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2010-4052
- patchhttp://cxib.net/stuff/proftpd.gnu.c
- exploithttps://bugzilla.redhat.com/show_bug.cgi?id=645859
- exploit20110107 GNU libc/regcomp(3) Multiple Vulnerabilities
FAQ
Common Questions.
Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by…
Affected: Glibc (Gnu) versions 1.00, 1.01, 1.02, 1.03, 1.04, 1.05, 1.06, 1.07; Azl3 Augeas 1.12.0-6 (Microsoft); Azl3 Smartmontools 7.4-1 (Microsoft), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Glibc 2.19-4, rootio-glibc 2.19-4.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2010-4052 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo