Executive brief
The brace-expansion library, a tool used to generate strings based on patterns, contains a flaw that can lead to excessive memory and CPU usage. An attacker can provide a specific pattern that forces the system to perform massive internal calculations even if a limit on the final output size is set. This can cause the application to slow down significantly or crash, leading to a denial-of-service for users.
Technical details
A vulnerability exists in the brace-expansion library (versions 5.0.0 to 5.0.5) due to improper enforcement of the 'max' option. When a large numeric range (e.g., {1..10000000}) is provided, the sequence generation loop creates all intermediate elements in memory before the 'max' limit is applied. This results in significant memory allocation (approx. 505 MB for 10 million elements) and CPU time (approx. 800ms) regardless of the configured output limit. An attacker can exploit this via network-delivered strings to cause a denial-of-service (DoS) through resource exhaustion. The issue is fixed in version 5.0.6.
Affected products
- juliangruber brace-expansion >=5.0.0 <5.0.6
Timeline
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-05-29: disclosed: CVE published to NVD