Inefficient Algorithmic Complexity in brace-expansion - CVE-2026-13149

Vulnerability identifier: #VU135820

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-13149

CWE-ID: CWE-407

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in expand() when processing attacker-influenced brace expansion patterns containing consecutive non-expanding {} groups. A remote attacker can send a specially crafted input string to cause a denial of service.

The issue can block the calling thread for minutes or indefinitely with a small all-ASCII input, and applications using Node's single-threaded event loop may fully stall a worker or process.

brace-expansion
Db2 Developer Extension
Maximo Application Suite - Visual Inspection Component
InfoSphere Optim Archive Viewer
QRadar Threat Intelligence
QRadar Pre-Validation App
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Fedora
Bitbucket Data Center
Jira Service Management Data Center
Jira Software Data Center
Ansible Automation Platform
Red Hat Advanced Cluster Security for Kubernetes
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Security SOAR
nodejs-nodemon (Red Hat package)
nodejs22 (Red Hat package)
nodejs22
nodejs24 (Red Hat package)
Red Hat OpenShift Container Platform
Informix Dynamic Server

Install security update from vendor's website.

brace-expansion - update to 5.0.7
Db2 Developer Extension - update to 1.2.0
Bitbucket Data Center - addressed in versions 9.4.23, 10.2.6, 10.4.2
Maximo Application Suite - Visual Inspection Component - addressed in versions 9.1.19, 9.2.1
Jira Service Management Data Center - addressed in versions 10.3.24, 11.3.10
Jira Software Data Center - addressed in versions 10.3.24, 11.3.9
InfoSphere Optim Archive Viewer - update to 11.7.0.15
IBM Security SOAR - update to 51.0.10.2
nodejs-nodemon (Red Hat package) - addressed in versions 3.1.14-2.el10_0, 3.1.14-2.el10_2
nodejs22 (Red Hat package) - addressed in versions 22.23.1-3.el10_0, 22.23.1-4.el10_2
nodejs22 - update to 22.23.4-4.fc45
nodejs24 (Red Hat package) - update to 24.18.0-3.el10_2
Ansible Automation Platform - update to 2.2.0
QRadar Threat Intelligence - update to 2.6.0
QRadar Pre-Validation App - update to 3.0.0
Red Hat Advanced Cluster Security for Kubernetes - update to 4.11.2
Red Hat OpenShift Container Platform - addressed in versions 4.18.52, 4.19.42, 4.20.31, 4.21.26
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.4.2
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.4.4
Informix Dynamic Server - addressed in versions 14.10.FC14W1, 15.0.1.16

• https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp

• Inefficient Algorithmic Complexity in brace-expansion
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.21
• Inefficient Algorithmic Complexity in Red Hat OpenShift Container Platform 4.20
• Red Hat Enterprise Linux 8 update for the nodejs:24 module
• Red Hat Enterprise Linux 10 update for nodejs-nodemon
• Red Hat Enterprise Linux 10 update for nodejs22
• Red Hat Enterprise Linux 10 update for nodejs24
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.11
• IBM Maximo Application Suite - Visual Inspection Component update for brace-expansion
• Red Hat Enterprise Linux 10 update for nodejs-nodemon
• Red Hat Enterprise Linux 10 update for nodejs22
• Inefficient Algorithmic Complexity in Red Hat OpenShift Container Platform 4.19
• Inefficient Algorithmic Complexity in Red Hat OpenShift Container Platform 4.18
• IBM Security SOAR update for brace-expansion
• Multiple vulnerabilities in Ansible Automation Platform 2.2 packages
• Multiple vulnerabilities in Bitbucket Data Center
• Multiple vulnerabilities in Jira Service Management Data Center
• Multiple vulnerabilities in Jira Software Data Center
• Multiple vulnerabilities in IBM Informix Dynamic Server
• IBM Db2 Developer Extension update for brace-expansion
• IBM InfoSphere Optim Archive Viewer update for brace-expansion
• Multiple vulnerabilities in IBM QRadar Threat Intelligence
• Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM QRadar Pre-Validation App
• Fedora 45 update for nodejs22
• Multiple vulnerabilities in IBM Watson Discovery