Inefficient Algorithmic Complexity in brace-expansion - CVE-2026-13149

Vulnerability identifier: #VU135820

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-13149

CWE-ID: CWE-407

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in expand() when processing attacker-influenced brace expansion patterns containing consecutive non-expanding {} groups. A remote attacker can send a specially crafted input string to cause a denial of service.

The issue can block the calling thread for minutes or indefinitely with a small all-ASCII input, and applications using Node's single-threaded event loop may fully stall a worker or process.

brace-expansion
Db2 Developer Extension
Maximo Application Suite - Visual Inspection Component
InfoSphere Optim Archive Viewer
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Bitbucket Data Center
Jira Software Data Center
Jira Service Management Data Center
Ansible Automation Platform
Red Hat Advanced Cluster Security for Kubernetes
IBM Security SOAR
nodejs-nodemon (Red Hat package)
nodejs22 (Red Hat package)
nodejs24 (Red Hat package)
Red Hat OpenShift Container Platform
Informix Dynamic Server

Install security update from vendor's website.

brace-expansion - update to 5.0.7
Db2 Developer Extension - update to 1.2.0
Bitbucket Data Center - addressed in versions 9.4.23, 10.2.6, 10.4.2
Maximo Application Suite - Visual Inspection Component - addressed in versions 9.1.19, 9.2.1
Jira Software Data Center - addressed in versions 10.3.24, 11.3.9
Jira Service Management Data Center - addressed in versions 10.3.24, 11.3.10
InfoSphere Optim Archive Viewer - update to 11.7.0.15
IBM Security SOAR - update to 51.0.10.2
Ansible Automation Platform - update to 2.2.0
nodejs-nodemon (Red Hat package) - addressed in versions 3.1.14-2.el10_0, 3.1.14-2.el10_2
Red Hat Advanced Cluster Security for Kubernetes - update to 4.11.2
Red Hat OpenShift Container Platform - addressed in versions 4.18.52, 4.19.42, 4.20.31, 4.21.26
Informix Dynamic Server - addressed in versions 14.10.FC14W1, 15.0.1.16
nodejs22 (Red Hat package) - addressed in versions 22.23.1-3.el10_0, 22.23.1-4.el10_2
nodejs24 (Red Hat package) - update to 24.18.0-3.el10_2

• https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp

• Inefficient Algorithmic Complexity in brace-expansion
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.21
• Inefficient Algorithmic Complexity in Red Hat OpenShift Container Platform 4.20
• Red Hat Enterprise Linux 8 update for the nodejs:24 module
• Red Hat Enterprise Linux 10 update for nodejs-nodemon
• Red Hat Enterprise Linux 10 update for nodejs22
• Red Hat Enterprise Linux 10 update for nodejs24
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.11
• IBM Maximo Application Suite - Visual Inspection Component update for brace-expansion
• Red Hat Enterprise Linux 10 update for nodejs-nodemon
• Red Hat Enterprise Linux 10 update for nodejs22
• Inefficient Algorithmic Complexity in Red Hat OpenShift Container Platform 4.19
• Inefficient Algorithmic Complexity in Red Hat OpenShift Container Platform 4.18
• IBM Security SOAR update for brace-expansion
• Multiple vulnerabilities in Ansible Automation Platform 2.2 packages
• Multiple vulnerabilities in Bitbucket Data Center
• Multiple vulnerabilities in Jira Service Management Data Center
• Multiple vulnerabilities in Jira Software Data Center
• Multiple vulnerabilities in IBM Informix Dynamic Server
• IBM Db2 Developer Extension update for brace-expansion
• IBM InfoSphere Optim Archive Viewer update for brace-expansion