EUVD-2026-16620Published
brace-expansion: Zero-step sequence causes process hang and memory exhaustion
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-33750 · Microsoft / collected KEV context
cve-program · CVE-2026-33750
- https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v
- https://github.com/juliangruber/brace-expansion/issues/98
- https://github.com/juliangruber/brace-expansion/pull/95
- https://github.com/juliangruber/brace-expansion/pull/96
- https://github.com/juliangruber/brace-expansion/pull/97
- https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5
- https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2
- https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a
- https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113
- https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184
euvd · EUVD-2026-16620
- https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v
- https://github.com/juliangruber/brace-expansion/issues/98
- https://github.com/juliangruber/brace-expansion/pull/95
- https://github.com/juliangruber/brace-expansion/pull/96
- https://github.com/juliangruber/brace-expansion/pull/97
- https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5
- https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2
- https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a
- https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113
- https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184
nvd · CVE-2026-33750
- https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113
- https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184
- https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5
- https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2
- https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a
- https://github.com/juliangruber/brace-expansion/issues/98
- https://github.com/juliangruber/brace-expansion/pull/95
- https://github.com/juliangruber/brace-expansion/pull/96
- https://github.com/juliangruber/brace-expansion/pull/97
- https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v
osv · GHSA-f886-m6hf-6m8v
- https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v
- https://nvd.nist.gov/vuln/detail/CVE-2026-33750
- https://github.com/juliangruber/brace-expansion/issues/98
- https://github.com/juliangruber/brace-expansion/pull/95
- https://github.com/juliangruber/brace-expansion/pull/96
- https://github.com/juliangruber/brace-expansion/pull/97
- https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5
- https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2
- https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a
- https://github.com/juliangruber/brace-expansion
- https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113
- https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.