juliangruber brace-expansion up to 1.1.17/2.1.3/3.0.5/5.0.8 expand allocation of resources

Summaryinfo

A vulnerability classified as problematic has been found in juliangruber brace-expansion up to 1.1.17/2.1.3/3.0.5/5.0.8. This affects the function expand. Performing a manipulation results in allocation of resources. This vulnerability is cataloged as CVE-2026-69152. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in juliangruber brace-expansion up to 1.1.17/2.1.3/3.0.5/5.0.8. It has been classified as problematic. This affects the function expand. The manipulation with an unknown input leads to a allocation of resources vulnerability. CWE is classifying the issue as CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. This is going to have an impact on availability. The summary by CVE is:

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-69152 since 08/03/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 331792 (Linux Distros Unpatched Vulnerability : CVE-2026-69152), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.1.18, 2.1.4, 3.0.6 or 5.0.9 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (331792), EUVD (EUVD-2026-52370) and CERT Bund (WID-SEC-2026-2816). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Red Hat Enterprise Linux
• Oracle Linux

Productinfo

Vendor

• juliangruber

Name

• brace-expansion

Version

• 1.1.0
• 1.1.1
• 1.1.2
• 1.1.3
• 1.1.4
• 1.1.5
• 1.1.6
• 1.1.7
• 1.1.8
• 1.1.9
• 1.1.10
• 1.1.11
• 1.1.12
• 1.1.13
• 1.1.14
• 1.1.15
• 1.1.16
• 1.1.17
• 2.1.0
• 2.1.1
• 2.1.2
• 2.1.3
• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4
• 5.0.5
• 5.0.6
• 5.0.7
• 5.0.8

Website

• Product: https://github.com/juliangruber/brace-expansion/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion