A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service (DoS) by supplying untrusted input containing deeply nested brace patterns. Due to uncontrolled recursion during pattern processing, expanding these nested structures exhausts the call stack and causes the application to crash.
Last checked: 2026-10-01 15:34 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-10-01 15:02 UTC)
Fix evidence last checked: 2026-10-22 21:30 UTC