CVE-2026-33750

A flaw was found in the brace-expansion library, a component used for generating strings based on patterns. A remote attacker could exploit this vulnerability by providing a specially crafted brace pattern that includes a zero step value. This malicious input causes the library's sequence generation loop to run indefinitely, leading to excessive memory allocation and causing the process to hang. This results in a Denial of Service (DoS) for the affected application.

This vulnerability has been rated as Moderate by Red Hat. The vulnerability requires parsing a malformed pattern that, when parsed, leads to infinite looping, excessive memory allocation, and could result in a DoS. The flaw is rated as Moderate because the vulnerable code in the brace-expansion library is not exposed directly as a network service, rather it needs to be called by another application; therefore, some user/system interaction is required to cause the malicious string to be processed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.