Bug 2542700 (CVE-2026-102278)

Summary:	CVE-2026-102278 brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aazores, abarbaro, abrianik, abuckta, akhatavk, akostadi, alizardo, amasferr, amctagga, anjoseph, anpicker, anthomas, anujha, aoconnor, aos-team-art-private, aschwart, asdas, asoldano, aszczucz, ataylor, bbaranow, bbrownin, bmaxwell, bniver, boliveir, bparees, brasmith, bsmejkal, bstansbe, cdrage, cmah, cmyers, cochase, csuconic, dbosanac, dbruscin, dfreiber, dkuc, dlofthou, dmayorov, dnakabaa, doconnor, dpaolell, dranck, drichtar, drow, dschmidt, dymurray, eaguilar, ebaron, ehelms, ehugonne, flucifre, fmariani, gbenhaim, ggainey, ggrzybek, gmalinko, gmeno, gotiwari, gparvin, groman, gtanzill, gtully, hasun, ibolton, ikhan, istudens, ivassile, iweiss, jachapma, janstey, jbalunas, jburrell, jbuscemi, jchui, jdelft, jfula, jhe, jhorak, jlanda, jlledo, jmatsuok, jmatthew, jmontleo, jowilson, jpasqual, jprabhak, jraez, jreimann, jsherman, jtolenti, jupierce, juwatts, jwon, kaycoth, kshier, ktsao, kvanderr, lchilton, lcouzens, lgarciaa, lryznaro, mbenjamin, mbiarnes, mcarlett, mdellweg, mdessi, mhackett, mhulan, mosmerov, mposolda, mreynolds, mrizzi, msauton, mstipich, msvehla, mvyas, nboldt, niyer, nmoumoul, nwallace, nyancey, oaljalju, ometelka, orabin, osousa, pantinor, parichar, pberan, pcattana, pcreech, pdelbell, pesilva, pgaikwad, pjindal, pmackay, ppalepu, ppostler, prdhamdh, progier, psrna, ptisnovs, rbobbitt, rchan, rexwhite, rgemmell, rgodfrey, rhaigner, rhel-process-autobot, rjohnson, rmartinc, rstancel, rstepani, rushinde, sdawley, sfeifer, sghai, sidsharm, simaishi, slucidi, smallamp, snegrini, sostapov, spichugi, sseago, ssilvert, stcannon, sthirugn, sthorger, suppawar, syedriko, tasato, tbish, tbordaz, tcunning, thjenkin, tlavocat, tmalecek, tsedmik, tsze, twaugh, vashirov, vdosoudi, vereddy, vkumar, vlaad, vmuzikar, watson-tool-maintainers, wtam, xdharmai, yfang, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service (DoS) by supplying untrusted input containing deeply nested brace patterns. Due to uncontrolled recursion during pattern processing, expanding these nested structures exhausts the call stack and causes the application to crash.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2550301, 2550303, 2550305, 2550307, 2550308, 2550309, 2550310, 2550311, 2550314, 2550315, 2550317, 2550319, 2550320, 2550322, 2550323, 2550324, 2550325, 2550326, 2550327, 2550328, 2550329, 2550330, 2550332, 2550333, 2550334, 2550335, 2550337, 2550338, 2552372, 2550312, 2550316, 2550331, 2550340, 2550341
Bug Blocks:

Description OSIDB Bzimport 2026-09-28 21:02:26 UTC

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.