brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

🗓️ 10 Jul 2026 05:14:22Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 12 Views

Brace expansion flaw in expand() enables denial of service via crafted input causing exponential time.

Reporter	Title	Published	Views	Family All 220
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses brace-expansion which is vulnerable to CVE-2026-13149	3 Aug 202608:35	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilitie	24 Jul 202615:43	–	ibm
IBM Security Bulletins	Security Bulletin: The Network Threat Analytics App for IBM QRadar SIEM contains components with known vulnerabilities	14 Aug 202618:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security SOAR is using a component with a known vulnerability (CVE-2026-13149)	27 Jul 202610:14	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in brace-expansion affects IBM Netezza Appliance	7 Aug 202612:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Data Product Hub	7 Aug 202616:35	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	5 Aug 202618:51	–	ibm
ATTACKERKB	CVE-2026-13149	30 Jun 202608:30	–	attackerkb
Amazon	Important: nodejs24	17 Aug 202600:00	–	amazon
Amazon	Important: nodejs22	17 Aug 202600:00	–	amazon

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	any	noarch	dotnet8	0-main@aarch64	[email protected]
Red Hat Enterprise Linux	any	noarch	dotnet8	0-main@x86_64	dotnet8-0-main@x86_64.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-13149
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-13149
cve	www.cve.org/CVERecord
npmjs	www.npmjs.com/package/brace-expansion

14 Jul 2026 15:02Current

6.2Medium risk

Vulners AI Score6.2

CVSS 48.7

EPSS0.00348

SSVC

Brace expansion Exponential time Denial of service Expand function vulnerability Crafted input