A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service (DoS) by supplying specially crafted string patterns with repeated closing braces. Processing these malformed patterns causes the string expansion logic to repeatedly rescan the entire input, leading to excessive processor and memory consumption that can temporarily block the application event loop.
Last checked: 2026-09-30 21:40 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-29 19:38 UTC)
Fix evidence last checked: 2026-10-16 10:02 UTC