Skip to main content

brace-expansion EUVDEUVD-2026-40269

| CVE-2026-13149 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-06-30 seal
Denial Of Service Brace Expansion Red Hat Suse
7.7
CVSS 4.0 · Vendor: seal
Share

Severity by source

Vendor (seal) PRIMARY
7.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber
vuln.today AI
7.5 HIGH

Untrusted input reaches expand() remotely with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only DoS (A:H, C/I:N) with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (seal).

CVSS VectorVendor: seal

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
N

Lifecycle Timeline

1
Analysis Generated
Jun 30, 2026 - 10:22 vuln.today

DescriptionCVE.org

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.

AnalysisAI

{}' brace groups to the expand() function, whose recursion is exponential in the number of such groups. Because brace-expansion is a near-ubiquitous transitive dependency (notably via minimatch/glob), any application that feeds untrusted input to expand() directly or indirectly is exposed. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Submit crafted brace pattern to app
Delivery
Input reaches expand() via minimatch/glob
Exploit
Consecutive '{}' groups trigger exponential recursion
Execution
CPU exhaustion blocks event loop
Impact
Service-wide denial of service
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The application must pass attacker-controlled string input into brace-expansion's expand() function, either directly or transitively (commonly through minimatch/glob pattern matching), and that input must be allowed to contain many consecutive non-expanding '{}' brace groups. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Signals are largely consistent and point to a real but bounded (availability-only) issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker submits a brace-pattern field to an application that forwards it (directly, or transitively via minimatch/glob) into brace-expansion's expand() - for example a search filter, file-match rule, or pattern parameter in an API. The crafted string contains many consecutive non-expanding '{}' groups, triggering exponential recursion that pegs CPU and blocks the Node.js event loop, rendering the service unresponsive to other requests. …
Remediation Upstream fix available (PR/commit); released patched version not independently confirmed - apply the change in commit c7e33ec13ac1a684c116720843ce24e208611754 (https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754) by upgrading to the patched release once published on https://www.npmjs.com/package/brace-expansion, and run 'npm audit'/'npm update' (or pin the transitive version via package.json 'overrides'/'resolutions') so nested copies pulled in through minimatch and glob are also bumped. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

24 hours: Identify all applications (first-party and commercial software) using minimatch or glob libraries; prioritize those accepting untrusted input including file uploads, API parameters, or user configuration. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2026-45498 MEDIUM POC
4.0
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5
CVE-2025-27469 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-40269 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy