GHSA-rgw5-rvv9-x895Published
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-69152 · Microsoft / collected KEV context
cve-program · CVE-2026-69152
- https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895
- https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d
- https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac
- https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf
- https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031
nvd · CVE-2026-69152
- https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d
- https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac
- https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf
- https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031
- https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895
osv · GHSA-rgw5-rvv9-x895
- https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895
- https://nvd.nist.gov/vuln/detail/CVE-2026-69152
- https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d
- https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac
- https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf
- https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031
- https://github.com/juliangruber/brace-expansion
Related operational evidence
Explicit CVE identifiers- Jira Software Data Center: DoS (Denial of Service) brace-expansion Dependency (CVE-2026-69152) · Security advisory · 15 Sep 2026