CVE-2026-45149

Katalog CVE

CVSS 7.5 · High EPSS 0,36%

Kerentanan Uncontrolled Resource Consumption pada juliangruber brace-expansion. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array. This vulnerability is fixed in 5.0.6.

Rincian

Terbit di NVD

29 Mei 2026

Terakhir diubah

22 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2 mitigasi · advisory vendor