CVE-2026-45149

Description

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array. This vulnerability is fixed in 5.0.6.

CVSS Metrics

• v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.30%• Percentile: 23%

Techniques & Countermeasures

• CWE-400•Uncontrolled Resource Consumption

  The product does not properly control the allocation and maintenance of a limited resource.

Affected Systems

• chainguard•actions-runner

  < 2.334.0-r2

• chainguard•airflow-2

  all

• chainguard•airflow-3

  < 3.2.2-r8

• chainguard•airflow-core-2

  all

• chainguard•arangodb-3.12

  < 3.12.9.4-r15

• chainguard•authentik-2026.5

  < 2026.5.4-r0

• chainguard•authentik-fips-2026.5

  < 2026.5.3-r6

• chainguard•commercial-gitlab-rails-ee-19.1

  all

• chainguard•commercial-gitlab-rails-ee-19.2

  all

• chainguard•commercial-gitlab-rails-ee-19.3

  all

• chainguard•commercial-gitlab-rails-ee-fips-19.1

  all

• chainguard•commercial-gitlab-rails-ee-fips-19.2

  all

• chainguard•commercial-gitlab-rails-ee-fips-19.3

  all

• chainguard•emscripten

  < 5.0.7-r1

• chainguard•gitlab-rails-ce-19.0

  all

• chainguard•gitlab-rails-ce-19.1

  all | < 19.1.7-r6

• chainguard•gitlab-rails-ce-19.2

  all | < 19.2.5-r2

• chainguard•gitlab-rails-ce-19.3

  < 19.3.1-r6

• chainguard•gitlab-rails-ce-fips-19.0

  all

• chainguard•gitlab-rails-ce-fips-19.1

  all | < 19.1.7-r7

• chainguard•gitlab-rails-ce-fips-19.2

  all | < 19.2.5-r2

• chainguard•gitlab-rails-ce-fips-19.3

  < 19.3.1-r3

• chainguard•kibana-8.19

  < 8.19.16-r1

• chainguard•kibana-8.19-bitnami

  < 8.19.16-r1

• chainguard•kibana-8.19-iamguarded

  < 8.19.16-r1

• chainguard•kibana-9.2

  < 9.2.8-r6

• chainguard•kibana-9.2-iamguarded

  < 9.2.8-r6

• chainguard•kibana-9.3

  < 9.3.5-r1

• chainguard•kibana-9.3-iamguarded

  < 9.3.5-r1

• chainguard•kibana-9.4

  < 9.4.3-r0

• chainguard•kibana-9.4-iamguarded

  < 9.4.3-r0

• chainguard•langfuse-2-worker

  < 2.95.12-r23

• chainguard•langfuse-3

  < 3.175.0-r0

• chainguard•langfuse-3-worker

  < 3.175.0-r0

• chainguard•langfuse-fips-2-worker

  < 2.95.12-r25

• chainguard•langfuse-fips-3

  < 3.175.0-r0

• chainguard•langfuse-fips-3-worker

  < 3.175.0-r0

• chainguard•lerna

  < 9.0.7-r5

• chainguard•npm

  < 11.15.0-r1

• chainguard•opensearch-dashboards-3-anomaly-detection-dashboards-plugin

  < 3.6.0-r5

• chainguard•opensearch-dashboards-3-fips-anomaly-detection-dashboards-plugin

  < 3.6.0-r7

• chainguard•prism

  < 5.15.10-r1

• chainguard•pulumi-language-nodejs

  < 3.243.0-r2

• chainguard•renovate

  < 43.170.15-r2

• chainguard•tileserver-gl

  < 5.6.0-r3

• chainguard•tileserver-gl-fips

  < 5.6.0-r3

• chainguard•ts-patch

  < 4.0.1-r1

• chainguard•vitess-22

  < 22.0.4-r12

• wolfi•airflow-3

  < 3.2.2-r8

• wolfi•langfuse-3

  < 3.175.0-r0

Showing first 50 affected entries in server-rendered view.

References (13)

• https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2
• https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5
• https://github.com/juliangruber/brace-expansion
• https://nvd.nist.gov/vuln/detail/CVE-2026-45149
• https://access.redhat.com/errata/RHSA-2026:13874
• https://images.redhat.com/
• https://access.redhat.com/security/cve/CVE-2026-45149
• https://access.redhat.com/security/updates/classification/
• https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13874.json
• https://bugzilla.redhat.com/show_bug.cgi?id=2483481
• https://www.cve.org/CVERecord?id=CVE-2026-45149
• https://security-tracker.debian.org/tracker/CVE-2026-45149
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45149.json