Inefficient regular expression complexity in brace-expansion - CVE-2025-5889

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU112890

Inefficient regular expression complexity in brace-expansion - CVE-2025-5889

Published: July 15, 2025


Vulnerability identifier: #VU112890
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2025-5889
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability: No public exploit available
Affected software:
brace-expansion
QRadar Investigation Assistant
Storage Sentinel Anomaly Scan Engine
DB2 Data Management Console
Guardium Data Security Center (GDSC)
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Data Product Hub
Knowledge Catalog Premium Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
WatsonX BI Assistant
Maximo Application Suite - Monitor Component
Maximo Application Suite - Edge Data Collector
IBM Business Automation Manager Open Editions
Maximo Application Suite - Visual Inspection Component
IBM Event Endpoint Management
Verify Identity Access Digital Credentials
Db2 Big SQL
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
Public Cloud Module
Python 3 Module
SUSE Package Hub 15
openSUSE Leap
openEuler
Voice Gateway
Communications Unified Assurance
watsonx.data
OpenShift Data Foundation (formerly OpenShift Container Storage)
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Maximo Application Suite
Oracle Communications Network Analytics Data Director
Event Streams
IBM QRadar Data Synchronization App
IBM App Connect Enterprise
IBM Security SOAR
IBM Security QRadar Analyst Workflow
Splunk Security Orchestration, Automation and Response (SOAR)
local-npm-registry
nodejs-brace-expansion
python311-pluggy
aws-cli
python311-boto3
python311-botocore
python311-pytest-metadata
python311-flaky
python311-pytest-mock
python311-pytest-html
python311-pytest-cov
python311-coverage-debuginfo
python-coverage-debugsource
python311-coverage
python311-pytest

Detailed vulnerability description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions. A remote user can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.


How to mitigate CVE-2025-5889

Install updates from vendor's website.

Sources