Linux Distros Unpatched Vulnerability : CVE-2026-102278

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace...

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

Summary expand recurses once per level of brace nesting. Deeply nested input exhausts the native stack and crashes the process. This is distinct from CVE-2026-14257 / GHSA-mh99-v99m-4gvg, which made the tail iterative recursion on m.post, driven by how many groups are chained. Nesting depth drive...

GHSA-QHR7-859C-M2P7 brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

Summary expand recurses once per level of brace nesting. Deeply nested input exhausts the native stack and crashes the process. This is distinct from CVE-2026-14257 / GHSA-mh99-v99m-4gvg, which made the tail iterative recursion on m.post, driven by how many groups are chained. Nesting depth drive...

AZL-105092 CVE-2026-102278 affecting package nodejs-nodemon 2.0.3-5

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before...

CVE-2026-102278

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before...

EUVD-2026-88555

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before...

CVE-2026-102278 brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before...

CVE-2026-102278 brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before...

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...

SUSE CVE-2026-13149

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in the number of consecutive non-expanding '' brace groups. An attacker who passes a crafted string to expand, directly or transitively, can cause significant CPU consumption...

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...

CVE-2026-13149

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...

DEBIAN-CVE-2026-13149

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in the number of consecutive non-expanding '' brace groups. An attacker who passes a crafted string to expand, directly or transitively, can cause significant CPU consumption...

CVE-2026-13149

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in the number of consecutive non-expanding '' brace groups. An attacker who passes a crafted string to expand, directly or transitively, can cause significant CPU consumption...

CVE-2026-4926

CVE-2026-4926 affects path-to-regexp where multiple sequential optional groups (e.g., {a}{b}{c}) cause the generated regular expression to grow exponentially, leading to denial of service. Connected sources confirm the impact and provide the remediation: a patch is released in version 8.4.0. Work...