brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

🗓️ 12 Aug 2026 06:10:10Reported by RedHatType

redhat🔗 access.redhat.com👁 9 Views

brace-expansion expand() function crashes apps via crafted input causing memory exhaustion and DoS.

Reporter	Title	Published	Views	Family All 224
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions	20 Aug 202615:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cyber Fraud includes components with multiple known vulnerabilities	20 Aug 202614:58	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	28 Aug 202605:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses brace-expansion-1.1.16.tgz which is vulnerable to CVE-2026-14257.	27 Aug 202619:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses brace-expansion-1.1.16.tgz which is vulnerable to multiple CVEs.	27 Aug 202619:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found in IBM DataPower Interact Gateway 12.1.1.1	2 Sep 202613:38	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by vulnerabilities in brace-expansion	19 Aug 202616:00	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in brace-expansion affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Aug 202618:11	–	ibm
ATTACKERKB	CVE-2026-14257	23 Jul 202612:54	–	attackerkb
Tenable Nessus	AlmaLinux 10 : nodejs22 (ALSA-2026:55541)	18 Aug 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	any	aarch64	nodejs24	24.18.1-0.2.1.hum1	nodejs24-24.18.1-0.2.1.hum1.aarch64.rpm
Red Hat Hardened Images	any	x86_64	nodejs24	24.18.1-0.2.1.hum1	nodejs24-24.18.1-0.2.1.hum1.x86_64.rpm
Red Hat Hardened Images	any	noarch	nodejs24-bin	24.18.1-0.2.1.hum1	nodejs24-bin-24.18.1-0.2.1.hum1.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-14257
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/juliangruber/brace-expansion
github	www.github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-14257
cve	www.cve.org/CVERecord
npmjs	www.npmjs.com/package/brace-expansion

05 Sep 2026 14:32Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.17.5

EPSS0.00466

SSVC

brace-expansion Denial of Service memory exhaustion expand() function out-of-memory