Bug 2542706 (CVE-2026-102277)
| Summary: | CVE-2026-102277 brace-expansion: brace-expansion: Denial of Service via crafted brace patterns | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aazores, abarbaro, abrianik, abuckta, akhatavk, akostadi, alizardo, amasferr, amctagga, anjoseph, anpicker, anthomas, anujha, aoconnor, aos-team-art-private, aschwart, asdas, asoldano, aszczucz, ataylor, bbaranow, bbrownin, bmaxwell, bniver, boliveir, bparees, brasmith, bsmejkal, bstansbe, cdrage, cmah, cmyers, cochase, csuconic, dbosanac, dbruscin, dfreiber, dkuc, dlofthou, dmayorov, dnakabaa, doconnor, dpaolell, dranck, drichtar, drow, dschmidt, dymurray, eaguilar, ebaron, ehelms, ehugonne, flucifre, fmariani, gbenhaim, ggainey, ggrzybek, gmalinko, gmeno, gotiwari, gparvin, groman, gtanzill, gtully, hasun, ibolton, ikhan, istudens, ivassile, iweiss, jachapma, janstey, jbalunas, jburrell, jbuscemi, jchui, jdelft, jfula, jhe, jhorak, jlanda, jlledo, jmatsuok, jmatthew, jmontleo, jowilson, jpasqual, jprabhak, jraez, jreimann, jsherman, jtolenti, jupierce, juwatts, jwon, kaycoth, kshier, ktsao, kvanderr, lchilton, lcouzens, lgarciaa, lryznaro, mbenjamin, mbiarnes, mcarlett, mdellweg, mdessi, mhackett, mhulan, mosmerov, mposolda, mreynolds, mrizzi, msauton, mstipich, msvehla, mvyas, nboldt, niyer, nmoumoul, nwallace, nyancey, oaljalju, ometelka, orabin, osousa, pantinor, parichar, pberan, pcattana, pcreech, pdelbell, pesilva, pgaikwad, pjindal, pmackay, ppalepu, ppostler, prdhamdh, progier, psrna, ptisnovs, rbobbitt, rchan, rexwhite, rgemmell, rgodfrey, rhaigner, rhel-process-autobot, rjohnson, rmartinc, rstancel, rstepani, rushinde, sdawley, sfeifer, sghai, sidsharm, simaishi, slucidi, smallamp, snegrini, sostapov, spichugi, sseago, ssilvert, stcannon, sthirugn, sthorger, suppawar, syedriko, tasato, tbish, tbordaz, tcunning, thjenkin, tlavocat, tmalecek, tsedmik, tsze, twaugh, vashirov, vdosoudi, vereddy, vkumar, vlaad, vmuzikar, watson-tool-maintainers, wtam, xdharmai, yfang, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service (DoS) by supplying specially crafted string patterns with repeated closing braces. Processing these malformed patterns causes the string expansion logic to repeatedly rescan the entire input, leading to excessive processor and memory consumption that can temporarily block the application event loop.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2548073, 2548074, 2548075, 2548076, 2548077, 2548078, 2548079, 2548081, 2548082, 2548084, 2548085, 2548087, 2548088, 2548089, 2548090, 2548091, 2548092, 2548093, 2548094, 2548095, 2548096, 2548097, 2548098, 2548099, 2548100, 2548101, 2548102, 2548104, 2548107, 2548080, 2548083, 2548086, 2548103, 2548105, 2548106 | ||
| Bug Blocks: | |||
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.