🟡 Medium  |  Source: Microsoft Security Response Center

CVE-2010-4052 is a denial-of-service vulnerability in the GNU C Library (glibc) affecting versions through 2.11.3 and 2.12.x through 2.12.2. A flaw in the regular expression compiler allows an attacker to craft a pattern with adjacent repetition operators that exhausts system resources, crashing dependent services. Although an older vulnerability, its appearance in the Microsoft Security Response Center suggests relevance to Azure-hosted workloads running affected glibc versions.

Security Architect’s Take: Audit Azure Linux VMs and container images for glibc versions older than 2.12.2 and ensure they are patched or replaced with a supported distribution; additionally, review any services that accept user-supplied regular expressions — particularly FTP daemons or custom apps — to ensure input validation is in place.

Original advisory: CVE-2010-4052 Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.