CVE-2026-13149

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-13149
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-13149.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-13149
Aliases
Downstream
ALSA (7)
CGA (388)
CLEANSTART (15)
CLSA (1)
DEBIAN (1)
ECHO (1)
MINI (42)
openSUSE (5)
RHSA (16)
RLSA (7)
ROOT (1)
SUSE (2)
UBUNTU (1)
Related
ALSA (7)
openSUSE (5)
SUSE (2)
Published
2026-06-30T08:30:34Z
Modified
2026-10-27T02:32:11Z
Severity
  • 7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber CVSS Calculator
Summary
[none]
Details

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.

Database specific 
{
    "cna_assigner": "seal",
    "cwe_ids": [
        "CWE-400",
        "CWE-407"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13149.json"
}
References

Affected packages

Git / github.com/juliangruber/brace-expansion

Affected ranges

Type
GIT
Repo
https://github.com/juliangruber/brace-expansion
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c7e33ec13ac1a684c116720843ce24e208611754
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "5.0.6"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "c7e33ec13ac1a684c116720843ce24e208611754"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

1.*
1.1.11
v1.*
v1.0.0
v1.0.1
v1.1.0
v1.1.1
v1.1.10
v1.1.11
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v2.*
v2.0.0
v2.0.1
v3.*
v3.0.0
v4.*
v4.0.0
v4.0.1
v5.*
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.0.6

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-13149.json"