brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash
Priority MEDIUM 40CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 27 fixed, 10 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00643 51st percentileScored 2026-11-07
Fix Partial brace-expansion (npm): 5.0.8, 3.0.3, 2.1.3 +1Red Hat: 40 advisoriesRed Hat: 27 fixed, 10 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| juliangruber | brace-expansion | up to 5.0.7 | — | No fix listed | CNA |
| — | brace-expansion (npm) | 4.0.0 to before 5.0.8 | 5.0.8 | Patch available | GHSA-mh99-v99m-4gvg |
| — | brace-expansion (npm) | 3.0.0 to before 3.0.3 | 3.0.3 | Patch available | GHSA-mh99-v99m-4gvg |
| — | brace-expansion (npm) | 2.0.0 to before 2.1.3 | 2.1.3 | Patch available | GHSA-mh99-v99m-4gvg |
| — | brace-expansion (npm) | before 1.1.17 | 1.1.17 | Patch available | GHSA-mh99-v99m-4gvg |
- brace-expansion Vendorjuliangruber Affected up to 5.0.7 Fixed in — No fix listed CNA
- brace-expansion (npm) Vendor— Affected 4.0.0 to before 5.0.8 Fixed in 5.0.8 Patch available GHSA-mh99-v99m-4gvg
- brace-expansion (npm) Vendor— Affected 3.0.0 to before 3.0.3 Fixed in 3.0.3 Patch available GHSA-mh99-v99m-4gvg
- brace-expansion (npm) Vendor— Affected 2.0.0 to before 2.1.3 Fixed in 2.1.3 Patch available GHSA-mh99-v99m-4gvg
- brace-expansion (npm) Vendor— Affected before 1.1.17 Fixed in 1.1.17 Patch available GHSA-mh99-v99m-4gvg
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:node.js:*:* | before 1.1.17; 2.0.0 to before 2.1.3; 3.0.0 to before 3.0.3; 4.0.0 to before 5.0.8 | Vulnerable | juliangruber |
- cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:node.js:*:* Versions before 1.1.17; 2.0.0 to before 2.1.3; 3.0.0 to before 3.0.3; 4.0.0 to before 5.0.8 Vulnerable ·juliangruber
Remediation
- Fix · GHSA-mh99-v99m-4gvg brace-expansion (npm) Fixed in 5.0.8 Advisory →
- Fix · GHSA-mh99-v99m-4gvg brace-expansion (npm) Fixed in 3.0.3 Advisory →
- Fix · GHSA-mh99-v99m-4gvg brace-expansion (npm) Fixed in 2.1.3 Advisory →
- Fix · GHSA-mh99-v99m-4gvg brace-expansion (npm) Fixed in 1.1.17 Advisory →
Red Hat 40 advisories
- RHSA-2026:92650 Released 2026-10-29 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.19.26 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
- RHSA-2026:70588 Released 2026-10-01 · Red Hat rating ImportantOpenShift Container Platform 4.17.58 security and extras update
- Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/ingress-node-firewall-rhel9, registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator, registry.redhat.io/openshift4/nmstate-console-plugin-rhel9 +9
- RHSA-2026:71179 Released 2026-09-23 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9 +10
Show 37 more Red Hat advisories
- RHSA-2026:70267 Released 2026-09-22 · Red Hat rating ImportantRed Hat Quay 3.14.9
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:68681 Released 2026-09-17 · Red Hat rating ImportantMigration Toolkit for Containers (MTC) 1.8.17 update
- Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-registry-rhel8, registry.redhat.io/rhmtc/openshift-migration-ui-rhel8
- RHSA-2026:65853 Released 2026-09-17 · Red Hat rating ImportantOpenShift Container Platform 4.18.55 security and extras update
- Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/ingress-node-firewall-rhel9, registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator, registry.redhat.io/openshift4/nmstate-console-plugin-rhel9 +4
- RHSA-2026:66372 Released 2026-09-16 · Red Hat rating ImportantOpenShift Container Platform 4.19.47 security and extras update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel9, registry.redhat.io/openshift4/ose-smb-csi-driver-rhel9
- RHSA-2026:67279 Released 2026-09-14 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.7 Container Release Update
- Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9 +7
- RHSA-2026:66003 Released 2026-09-09 · Red Hat rating ImportantAnsible automation portal Red Hat Enterprise Linux Images
- Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9
- RHSA-2026:64817 Released 2026-09-08 · Red Hat rating Importantnodejs22 security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) nodejs-1:22.23.2-1.el10_0, nodejs-devel-1:22.23.2-1.el10_0, nodejs-docs-1:22.23.2-1.el10_0 +4
- RHSA-2026:62416 Released 2026-09-02 · Red Hat rating Importantnodejs:22 security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.aarch64::nodejs:22, nodejs-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.ppc64le::nodejs:22, nodejs-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.s390x::nodejs:22 +28
- RHSA-2026:60447 Released 2026-09-01 · Red Hat rating ImportantOpenShift Container Platform 4.20.36 security and extras update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9, registry.redhat.io/openshift4/ose-cluster-capacity-rhel9 +1
- RHSA-2026:60478 Released 2026-09-01 · Red Hat rating ImportantOpenShift Container Platform 4.21.31 security and extras update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-cluster-capacity-rhel9
- RHSA-2026:59583 Released 2026-08-25 · Red Hat rating ImportantKiali 2.27.3 for Red Hat OpenShift Service Mesh 3.4
- Red Hat OpenShift Service Mesh 3.4 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2026:59566 Released 2026-08-25 · Red Hat rating ImportantKiali 2.22.9 for Red Hat OpenShift Service Mesh 3.3
- Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2026:59561 Released 2026-08-25 · Red Hat rating ImportantKiali 2.11.16 for Red Hat OpenShift Service Mesh 3.1
- Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2026:59554 Released 2026-08-25 · Red Hat rating ImportantKiali 2.17.13 for Red Hat OpenShift Service Mesh 3.2
- Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2026:59548 Released 2026-08-25 · Red Hat rating ImportantKiali 2.4.22 for Red Hat OpenShift Service Mesh 3.0
- Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2026:57365 Released 2026-08-25 · Red Hat rating ImportantOpenShift Container Platform 4.22.11 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/oc-mirror-plugin-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9 +6
- RHSA-2026:57801 Released 2026-08-25 · Red Hat rating ImportantOpenShift Container Platform 4.21.30 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +2
- RHSA-2026:57545 Released 2026-08-25 · Red Hat rating ImportantOpenShift Container Platform 4.20.35 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +4
- RHSA-2026:57367 Released 2026-08-25 · Red Hat rating ImportantOpenShift Container Platform 4.22.11 security and extras update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel9, registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel9-operator
- RHSA-2026:59159 Released 2026-08-24 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Container Release Update
- Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/controller-rhel8, registry.redhat.io/ansible-automation-platform-25/hub-rhel8, registry.redhat.io/ansible-automation-platform-25/lightspeed-rhel8
- RHSA-2026:59155 Released 2026-08-24 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9 +5
- RHSA-2026:58819 Released 2026-08-24 · Red Hat rating Importantnodejs24 security update
- Red Hat Enterprise Linux AppStream (v. 10) nodejs24-1:24.18.0-5.el10_2, nodejs24-devel-1:24.18.0-5.el10_2, nodejs24-docs-1:24.18.0-5.el10_2 +3
- RHSA-2026:57590 Released 2026-08-20 · Red Hat rating Importantrh-podman-desktop security, bug fix, and enhancement update
- Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop-1.1.2-1.el10_2
- RHSA-2026:56357 Released 2026-08-18 · Red Hat rating ImportantAnsible plug-ins for Red Hat Developer Hub Product Release Update
- Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/automation-portal
- RHSA-2026:56338 Released 2026-08-18 · Red Hat rating ImportantAnsible plug-ins for Red Hat Developer Hub Product Release Update
- Red Hat Ansible Automation Platform 2.1 registry.redhat.io/ansible-automation-platform/automation-portal
- RHSA-2026:55603 Released 2026-08-17 · Red Hat rating Importantnodejs:24 security update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:24.18.0-6.module+el9.8.0+24638+75f46aee.aarch64::nodejs:24, nodejs-1:24.18.0-6.module+el9.8.0+24638+75f46aee.ppc64le::nodejs:24, nodejs-1:24.18.0-6.module+el9.8.0+24638+75f46aee.s390x::nodejs:24 +25
- RHSA-2026:55601 Released 2026-08-17 · Red Hat rating Importantnodejs:22 security update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:22.23.1-3.module+el9.8.0+24637+e0b636e5.aarch64::nodejs:22, nodejs-1:22.23.1-3.module+el9.8.0+24637+e0b636e5.ppc64le::nodejs:22, nodejs-1:22.23.1-3.module+el9.8.0+24637+e0b636e5.s390x::nodejs:22 +28
- RHSA-2026:55541 Released 2026-08-17 · Red Hat rating Importantnodejs22 security update
- Red Hat Enterprise Linux AppStream (v. 10) nodejs-1:22.23.1-6.el10_2, nodejs-devel-1:22.23.1-6.el10_2, nodejs-docs-1:22.23.1-6.el10_2 +4
- RHSA-2026:54760 Released 2026-08-13 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:54530 Released 2026-08-13 · Red Hat rating Importantnodejs:22 security update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:22.23.1-3.module+el8.10.0+24640+6eba5e6e.aarch64::nodejs:22, nodejs-1:22.23.1-3.module+el8.10.0+24640+6eba5e6e.ppc64le::nodejs:22, nodejs-1:22.23.1-3.module+el8.10.0+24640+6eba5e6e.s390x::nodejs:22 +28
- RHSA-2026:54371 Released 2026-08-12 · Red Hat rating Importantnodejs:24 security update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:24.18.0-3.module+el8.10.0+24639+56878497.aarch64::nodejs:24, nodejs-1:24.18.0-3.module+el8.10.0+24639+56878497.ppc64le::nodejs:24, nodejs-1:24.18.0-3.module+el8.10.0+24639+56878497.s390x::nodejs:24 +25
- RHSA-2026:54389 Released 2026-08-12 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images nodejs26-1:26.7.0-1.5.2.hum1@aarch64, nodejs26-1:26.7.0-1.5.2.hum1@src, nodejs26-1:26.7.0-1.5.2.hum1@x86_64 +16
- RHSA-2026:54183 Released 2026-08-12 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images nodejs24-1:24.18.1-0.2.1.hum1@aarch64, nodejs24-1:24.18.1-0.2.1.hum1@src, nodejs24-1:24.18.1-0.2.1.hum1@x86_64 +16
- RHSA-2026:50290 Released 2026-08-04 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images grafana12.4-12.4.6-0.4.hum1@aarch64, grafana12.4-12.4.6-0.4.hum1@src, grafana12.4-12.4.6-0.4.hum1@x86_64
- RHSA-2026:45784 Released 2026-07-25 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images nodejs24-1:24.18.0-0.5.hum1@aarch64, nodejs24-1:24.18.0-0.5.hum1@src, nodejs24-1:24.18.0-0.5.hum1@x86_64 +14
- RHSA-2026:45381 Released 2026-07-24 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images nodejs22-1:22.23.1-2.3.hum1@aarch64, nodejs22-1:22.23.1-2.3.hum1@src, nodejs22-1:22.23.1-2.3.hum1@x86_64 +16
- RHSA-2026:45360 Released 2026-07-24 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images nodejs26-1:26.5.0-1.4.hum1@aarch64, nodejs26-1:26.5.0-1.4.hum1@src, nodejs26-1:26.5.0-1.4.hum1@x86_64 +16
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix yet |
| OpenShift Lightspeed | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat Hardened Images | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Red Hat Ansible Automation Platform 2.1 | Fixed | RHSA-2026:56338 |
| Red Hat Ansible Automation Platform 2.2 | Fixed | RHSA-2026:56357, RHSA-2026:66003 |
| Red Hat Ansible Automation Platform 2.5 | Fixed | RHSA-2026:59159 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:59155, RHSA-2026:71179 |
| Red Hat Ansible Automation Platform 2.7 | Fixed | RHSA-2026:67279 |
| Red Hat Discovery 2 | Fixed | RHSA-2026:54760 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:55541, RHSA-2026:58819 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:54371, RHSA-2026:54530 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:55601, RHSA-2026:55603 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:64817 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:62416 |
| Red Hat Enterprise Linux Extensions Channel (v. 10) | Fixed | RHSA-2026:57590 |
| Red Hat Hardened Images | Fixed | RHSA-2026:45360, RHSA-2026:45381, RHSA-2026:45784, RHSA-2026:50290, RHSA-2026:54183, RHSA-2026:54389 |
| Red Hat Migration Toolkit 1.8 | Fixed | RHSA-2026:68681 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2026:70588 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2026:65853 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:66372 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:57545, RHSA-2026:60447 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:57801, RHSA-2026:60478 |
| Red Hat OpenShift Container Platform 4.22 | Fixed | RHSA-2026:57365, RHSA-2026:57367 |
| Red Hat OpenShift Service Mesh 3.0 | Fixed | RHSA-2026:59548 |
| Red Hat OpenShift Service Mesh 3.1 | Fixed | RHSA-2026:59561 |
| Red Hat OpenShift Service Mesh 3.2 | Fixed | RHSA-2026:59554 |
| Red Hat OpenShift Service Mesh 3.3 | Fixed | RHSA-2026:59566 |
| Red Hat OpenShift Service Mesh 3.4 | Fixed | RHSA-2026:59583 |
| Red Hat Openshift Data Foundation 4.19 | Fixed | RHSA-2026:92650 |
| Red Hat Quay 3.14 | Fixed | RHSA-2026:70267 |
Not affected: 57 products
- Cryostat 4
- Gatekeeper 3
- Migration Toolkit for Applications 8
- Node HealthCheck Operator
- OpenShift Pipelines
- OpenShift Service Mesh 3
- Red Hat 3scale API Management Platform 2
- Red Hat AMQ Broker 7
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.5
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.7
- Red Hat Build of Keycloak
- Red Hat Build of Podman Desktop
- Red Hat Connectivity Link 1
- Red Hat Data Grid 8
- Red Hat Developer Hub 1
- Red Hat Directory Server 11
- Red Hat Directory Server 12
- Red Hat Directory Server 13
- Red Hat Discovery 2
- Red Hat Edge Manager 1
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Hardened Images
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat Migration Toolkit 1.8
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Container Platform 4.18
- Red Hat OpenShift Container Platform 4.19
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.21
- Red Hat OpenShift Container Platform 4.22
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift Service Mesh 3.4
- Red Hat OpenShift Virtualization 4
- Red Hat Openshift Data Foundation 4.19
- Red Hat Quay 3
- Red Hat Quay 3.14
- Red Hat Satellite 6
- Red Hat Trusted Profile Analyzer
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat build of Apicurio Registry 3
- Secrets Management Console for Red Hat OpenShift
- streams for Apache Kafka 2
- streams for Apache Kafka 3
Timeline
- 2026-10-02 Threatist record created from CVE-2026-14257
- 2026-10-03 Alias added: GHSA-mh99-v99m-4gvg
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-21 EPSS moved to the 50th–90th percentile
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-30 Fix available: Red Hat Openshift Data Foundation 4.19 · Red Hat
- 2026-10-31 Fix available: RHSA-2026:92650 · Red Hat
References
Patch 1
Other 9
- GHSA-mh99-v99m-4gvg
- https://github.com/juliangruber/brace-expansion
- https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg
- https://github.com/juliangruber/brace-expansion/pull/129
- https://github.com/juliangruber/brace-expansion/pull/130
- https://github.com/juliangruber/brace-expansion/pull/136
- https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d
- https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031
- https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb
More juliangruber Brace-expansion vulnerabilities
- TI-2026-48532 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation CVSS 3.1HIGH 7.5
- TI-2026-32977 brace-expansion: Large numeric range defeats documented `max` DoS protection CVSS 3.1HIGH 7.5
- TI-2026-26129 brace-expansion: Zero-step sequence causes process hang and memory exhaustion CVSS 3.1HIGH 7.5
Sources
- CVE-2026-14257 · CVE Program
- CVE-2026-14257 · NVD
- FIRST EPSS
- GHSA-mh99-v99m-4gvg · GitHub Advisory Database · CC BY 4.0
- CVE-2026-14257 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences