← Vulnerability feed

Vulnerability record · CVE-2026-69152 · published 3 August 2026

CVE-2026-69152: Juliangruber brace-expansion uncontrolled resource consumption vulnerability

Juliangruber · Brace Expansion

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.

7.5 CVSS 3.1 High EPSS 0.65% · top 51.1% CWE-400 · Uncontrolled resource consumptionCWE-770 · Allocation without limits
7.5CVSS 3.1 base score
0.65%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
5 Aug 2026Last modified by NVD

Description

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d Patch
https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac Patch
https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf Patch
https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031 Patch
https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895 ExploitMitigationVendor Advisory
https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895 ExploitMitigationVendor Advisory

Track CVE-2026-69152 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2026-14257Juliangruber brace-expansion uncontrolled resource consumption vulnerabilitybrace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max…EPSS 0.64%7.5CVE-2026-45149Juliangruber brace-expansion uncontrolled resource consumption vulnerabilityThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being a…EPSS 0.36%7.5CVE-2026-33750Juliangruber brace-expansion uncontrolled resource consumption vulnerabilityThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a b…EPSS 0.61%7.5CVE-2026-28318SolarWinds Serv-U unauthenticated POST request denial of serviceSolarWinds Serv-U crashes when it receives a specially crafted POST request using Content-Encoding: deflate, and the crash occurs without authenticat…KEVEPSS 1.9%analysed7.5CVE-2026-45498Microsoft Defender antimalware platform uncontrolled resource consumption DoSCVE-2026-45498 is a denial of service flaw in the Microsoft Defender antimalware platform, classified as uncontrolled resource consumption (CWE-400).…KEVEPSS 1.3%analysed7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed7.5CVE-2023-38180Microsoft .NET and Visual Studio uncontrolled resource consumption DoSCVE-2023-38180 is a denial-of-service flaw in Microsoft .NET, ASP.NET Core and Visual Studio 2022, classified as uncontrolled resource consumption (C…KEVEPSS 14%analysed5.9CVE-2004-1464Cisco IOS Telnet VTY resource exhaustion denial of serviceCisco IOS 12.2(15) and earlier fails to properly handle crafted TCP connections to the Telnet or reverse Telnet port, exhausting virtual terminal (VT…KEVEPSS 4.8%analysed

Source: NIST National Vulnerability Database (record CVE-2026-69152), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.