Memory Exhaustion in braces
Priority MEDIUM 42CWE-1050Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 13 fixed, 44 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01471 73rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial braces (npm): 3.0.3Red Hat: 8 advisoriesRed Hat: 13 fixed, 44 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | braces (npm) | before 3.0.3 | 3.0.3 | Patch available | GHSA-grv7-fg5c-xmjg |
- braces (npm) Vendor— Affected before 3.0.3 Fixed in 3.0.3 Patch available GHSA-grv7-fg5c-xmjg
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jonschlinkert:braces:*:*:*:*:*:node.js:*:* | before 3.0.3 | Vulnerable | micromatch |
- cpe:2.3:a:jonschlinkert:braces:*:*:*:*:*:node.js:*:* Versions before 3.0.3 Vulnerable ·micromatch
Remediation
- Fix · GHSA-grv7-fg5c-xmjg braces (npm) Fixed in 3.0.3 Advisory →
Red Hat 8 advisories
- RHSA-2026:34342 Released 2026-07-01 · Red Hat rating CriticalCluster Observability Operator 1.5.0
- Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9 +9
- RHSA-2024:11023 Released 2024-12-12 · Red Hat rating ImportantHawtIO 4.1.0 for Red Hat build of Apache Camel 4 Release and security update.
- HawtIO 4.0.0 for Red Hat build of Apache Camel 4
- RHSA-2024:8075 Released 2024-10-14 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.19 Security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-hal-console-3.3.24-1.Final_redhat_00001.1.el7eap, eap7-hibernate-validator-6.0.23-2.SP1_redhat_00001.1.el7eap, eap7-hibernate-validator-cdi-6.0.23-2.SP1_redhat_00001.1.el7eap +24
Show 5 more Red Hat advisories
- RHSA-2024:8076 Released 2024-10-14 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.19 Security update
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-hal-console-3.3.24-1.Final_redhat_00001.1.el8eap, eap7-hibernate-validator-6.0.23-2.SP1_redhat_00001.1.el8eap, eap7-hibernate-validator-cdi-6.0.23-2.SP1_redhat_00001.1.el8eap +25
- RHSA-2024:8077 Released 2024-10-14 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.19 Security update
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-hal-console-3.3.24-1.Final_redhat_00001.1.el9eap, eap7-hibernate-validator-6.0.23-2.SP1_redhat_00001.1.el9eap, eap7-hibernate-validator-cdi-6.0.23-2.SP1_redhat_00001.1.el9eap +25
- RHSA-2024:7164 Released 2024-09-26 · Red Hat rating ImportantMigration Toolkit for Containers (MTC) 1.8.4 security and bug fix update
- 8Base-RHMTC-1.8 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-ui-rhel8
- RHSA-2024:6211 Released 2024-09-03 · Red Hat rating ImportantRed Hat OpenShift Service Mesh Containers for 2.6.1 security update
- RHOSSM 2.6 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +6
- RHOSSM 2.6 for RHEL 9 openshift-service-mesh/proxyv2-rhel9
- RHSA-2024:4464 Released 2024-07-10 · Red Hat rating LowRed Hat Advanced Cluster Management 2.10.4 security updates and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 rhacm2/acm-cluster-permission-rhel9, rhacm2/console-rhel9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 2 | Affected | No fix yet |
| Logging Subsystem for Red Hat OpenShift | Affected | — |
| Migration Toolkit for Applications 7 | Affected | No fix planned: Will not fix |
| Migration Toolkit for Runtimes | Affected | No fix yet |
| Migration Toolkit for Virtualization | Affected | No fix yet |
| Network Observability Operator | Affected | No fix planned: Will not fix |
| Node HealthCheck Operator | Affected | No fix planned: Will not fix |
| OpenShift Pipelines | Affected | — |
| OpenShift Serverless | Affected | No fix planned: Will not fix |
| Red Hat 3scale API Management Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Security 3 | Affected | — |
| Red Hat Advanced Cluster Security 4 | Affected | — |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Build of Keycloak | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Discovery 1 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.11 | Affected | — |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | — |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Container Storage 4 | Affected | No fix yet |
| Red Hat Process Automation 7 | Affected | No fix planned: Will not fix |
| Red Hat Quay 3 | Affected | — |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix planned: Will not fix |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| Red Hat build of OptaPlanner 8 | Affected | No fix planned: Will not fix |
| 8Base-RHMTC-1.8 | Fixed | RHSA-2024:7164 |
| Cluster Observability Operator 1.5 | Fixed | RHSA-2026:34342 |
| HawtIO 4.0.0 for Red Hat build of Apache Camel 4 | Fixed | RHSA-2024:11023 |
| RHOSSM 2.6 for RHEL 8 | Fixed | RHSA-2024:6211 |
| RHOSSM 2.6 for RHEL 9 | Fixed | RHSA-2024:6211 |
| Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 | Fixed | RHSA-2024:4464 |
| Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 | Fixed | — |
| Red Hat Developer Hub 1.3 for RHEL 9 | Fixed | — |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2024:8075 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2024:8076 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2024:8077 |
| multicluster engine for Kubernetes 2.4 for RHEL 8 | Fixed | — |
| multicluster engine for Kubernetes 2.5 for RHEL 9 | Fixed | — |
Not affected: 13 products
- 8Base-RHMTC-1.8
- Cluster Observability Operator 1.5
- Migration Toolkit for Applications 7
- Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9
- Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
- Red Hat Ansible Automation Platform 2
- Red Hat Developer Hub 1.3 for RHEL 9
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Openshift Data Foundation 4
- multicluster engine for Kubernetes 2.4 for RHEL 8
- multicluster engine for Kubernetes 2.5 for RHEL 8
- multicluster engine for Kubernetes 2.5 for RHEL 9
Timeline
- 2026-10-02 Threatist record created from CVE-2024-4068
- 2026-10-03 Alias added: GHSA-grv7-fg5c-xmjg
- 2026-11-05 Fix available: Cluster Observability Operator 1.5 · Red Hat
References
Patch 2
Advisory 2
Sources
- CVE-2024-4068 · CVE Program
- CVE-2024-4068 · NVD
- FIRST EPSS
- GHSA-grv7-fg5c-xmjg · GitHub Advisory Database · CC BY 4.0
- CVE-2024-4068 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences