brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

🗓️ 10 Aug 2026 13:26:22Reported by RedHatType

redhat🔗 access.redhat.com👁 11 Views

brace-expansion expand() creates unbounded arrays, causing memory exhaustion and DoS via crafted input.

Reporter	Title	Published	Views	Family All 232
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	28 Aug 202605:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses brace-expansion-1.1.16.tgz which is vulnerable to multiple CVEs.	27 Aug 202619:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found in IBM DataPower Interact Gateway 12.1.1.1	2 Sep 202613:38	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by vulnerabilities in brace-expansion	19 Aug 202616:00	–	ibm
ATTACKERKB	CVE-2026-69152	3 Aug 202616:33	–	attackerkb
Tenable Nessus	AlmaLinux 10 : nodejs22 (ALSA-2026:55541)	18 Aug 202600:00	–	nessus
Tenable Nessus	AlmaLinux 9 : nodejs:24 (ALSA-2026:55603)	1 Sep 202600:00	–	nessus
Tenable Nessus	AlmaLinux 10 : nodejs24 (ALSA-2026:58819)	25 Aug 202600:00	–	nessus
Tenable Nessus	MiracleLinux 8 : nodejs:24 (AXSA:2026-1566:01)	18 Aug 202600:00	–	nessus
Tenable Nessus	MiracleLinux 8 : nodejs:22 (AXSA:2026-1596:01)	20 Aug 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	10.2	noarch	nodejs-nodemon	3.1.14-3.el10_2	nodejs-nodemon-3.1.14-3.el10_2.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-69152
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d
github	www.github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac
github	www.github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf
github	www.github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031
github	www.github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-69152
cve	www.cve.org/CVERecord

05 Sep 2026 21:26Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.17.5

EPSS0.00623

SSVC

brace-expansion Denial of Service expand() function unbounded arrays memory exhaustion CVE-2026-14257 bypass