Bug 2506433 (CVE-2026-14257) - CVE-2026-14257 brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function
Summary: CVE-2026-14257 brace-expansion: Brace-expansion: Denial of Service via memory...
Keywords:
Status: NEW
Alias: CVE-2026-14257
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-23 14:01 UTC by OSIDB Bzimport
Modified: 2026-09-02 07:31 UTC (History)
156 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:54371 0 None None None 2026-08-12 14:17:33 UTC
Red Hat Product Errata RHSA-2026:54530 0 None None None 2026-08-13 11:34:52 UTC
Red Hat Product Errata RHSA-2026:55541 0 None None None 2026-08-17 09:49:51 UTC
Red Hat Product Errata RHSA-2026:55601 0 None None None 2026-08-17 11:59:08 UTC
Red Hat Product Errata RHSA-2026:55603 0 None None None 2026-08-17 14:34:05 UTC
Red Hat Product Errata RHSA-2026:57590 0 None None None 2026-08-20 16:07:43 UTC
Red Hat Product Errata RHSA-2026:58819 0 None None None 2026-08-24 06:57:15 UTC
Red Hat Product Errata RHSA-2026:62416 0 None None None 2026-09-02 07:31:42 UTC

Description OSIDB Bzimport 2026-07-23 14:01:49 UTC 
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.
Comment 3 errata-xmlrpc 2026-08-12 14:17:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:54371 https://access.redhat.com/errata/RHSA-2026:54371
Comment 4 errata-xmlrpc 2026-08-13 11:34:43 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:54530 https://access.redhat.com/errata/RHSA-2026:54530
Comment 6 errata-xmlrpc 2026-08-17 09:49:42 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:55541 https://access.redhat.com/errata/RHSA-2026:55541
Comment 7 errata-xmlrpc 2026-08-17 11:59:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:55601 https://access.redhat.com/errata/RHSA-2026:55601
Comment 8 errata-xmlrpc 2026-08-17 14:33:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:55603 https://access.redhat.com/errata/RHSA-2026:55603
Comment 9 errata-xmlrpc 2026-08-20 16:07:35 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:57590 https://access.redhat.com/errata/RHSA-2026:57590
Comment 10 errata-xmlrpc 2026-08-24 06:57:07 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:58819 https://access.redhat.com/errata/RHSA-2026:58819
Comment 11 errata-xmlrpc 2026-09-02 07:31:34 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:62416 https://access.redhat.com/errata/RHSA-2026:62416
Note You need to log in before you can comment on or make changes to this bug.