RHSA-2026:50931 | Vulnetix

RHSA-2026:50931 PUBLISHED CVSS 8.199999809265137 HIGH

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.

Risk Scores

CVSS 3.1

8.199999809265137

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Affected Products

Vendor	Product	Versions
Red Hat	registry.redhat.io/quay/clair-rhel8@sha256:84519688f09c3b1d1bfa8047b43ee9d66beccf2388a1962c4143fbc1b9ebb8ab_amd64 as a component of Red Hat Quay 3.9	,
Red Hat	registry.redhat.io/quay/quay-operator-rhel8@sha256:9723f8105532482e1a42da8d97bf5a9984680b019d5e1bd86580bacdd6c3453c_ppc64le as a component of Red Hat Quay 3.9	,
Red Hat	registry.redhat.io/quay/quay-builder-rhel8@sha256:fb7dd607364f3ce80ab5b788c4728dbabee96087479eb717df3909b81575b144_s390x as a component of Red Hat Quay 3.9	,
Red Hat	registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:f4f8f737998c04b6302aeb28db5aebdfda8aea4beb08a546ba0e65c2bf86bddc_amd64 as a component of Red Hat Quay 3.9	,
Red Hat	registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:023666d9184b8a3ae449f8b2260ef331e7403f7c70682c394946d0d830530979_amd64 as a component of Red Hat Quay 3.9	,
Red Hat	registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ab69968f754d9364a897b3f730961a68de05df087469c1ba515401e5d09a416d_ppc64le as a component of Red Hat Quay 3.9	,

Red Hat	registry.redhat.io/quay/clair-rhel8@sha256:91dbd3703bed9f6b9cd5af2c4fd4e2c909d3894d5859bb38cd0aff779712fd1f_ppc64le as a component of Red Hat Quay 3.9	,
Red Hat	registry.redhat.io/quay/quay-builder-rhel8@sha256:e6924420001257e731f371bcd9aff7b8341a9d6c6d38ff0ed67668bc3b684fe0_ppc64le as a component of Red Hat Quay 3.9	,
Red Hat	registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:acb7bb6e62d1d1236333c8b785616587d1f3674c5458af0f429086756fc44b03_amd64 as a component of Red Hat Quay 3.9	,
Red Hat	registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:a5b5afb1630f563b4e3eff6ac3c6efb8ab011d75f49ccab7cee7391cd4d83532_amd64 as a component of Red Hat Quay 3.9	,
Red Hat	registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5915e4c0e0fb26d7e251b73e80fcb6e706d6f829db44132e002a08b420e3b041_ppc64le as a component of Red Hat Quay 3.9	,
Red Hat	registry.redhat.io/quay/quay-operator-rhel8@sha256:05be0dc429ac55dd27dba6489c32fd43a53eb62ec062528b066ce49b3d2d056d_amd64 as a component of Red Hat Quay 3.9	,
Red Hat	registry.redhat.io/quay/quay-rhel8@sha256:f6cfbe5b8c58d6dbbddc1a809643ffe95f0e54a1a1571bde6748bd2664bb8883_s390x as a component of Red Hat Quay 3.9	,
Red Hat	registry.redhat.io/quay/quay-rhel8@sha256:d6918deb61a5917a667cc8b58da97eef5268e967e44c75c31950ff3f1840a187_amd64 as a component of Red Hat Quay 3.9	,
Red Hat	registry.redhat.io/quay/clair-rhel8@sha256:1745fe5e9d61d508defcab20917b10f07a93f59f585d2db3b4e0e90f5a575810_s390x as a component of Red Hat Quay 3.9	,
Red Hat	registry.redhat.io/quay/quay-operator-rhel8@sha256:19949390f105f181b89b01bc3bdb5c9c94e576337e287dd55d49051cee861a51_s390x as a component of Red Hat Quay 3.9	,
Red Hat	registry.redhat.io/quay/quay-builder-rhel8@sha256:162390f2b74fd3f3a079e5c0faa0996b8933f60fa6d1522bba786c743f1eb2d8_amd64 as a component of Red Hat Quay 3.9	,
Red Hat	registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:a7bd337dd766137f2e3a3f99ff22184e82e486f674ff46efa10a7429dbeb66bb_s390x as a component of Red Hat Quay 3.9	,
Red Hat	registry.redhat.io/quay/quay-operator-bundle@sha256:ee8284581f4f451535ff4bb4c1c430fed31cd92df37a8cb96410f1cf62c2a4cc_amd64 as a component of Red Hat Quay 3.9	,

…and 4 more

Timeline

Aug 5, 2026 CVE Published
Aug 24, 2026 CVE Updated
Aug 24, 2026 Distribution Patch
Aug 24, 2026 Distribution Patch
Aug 24, 2026 Security Advisory
Aug 24, 2026 Security Advisory
Aug 24, 2026 Security Advisory
Aug 24, 2026 Security Advisory
Aug 24, 2026 Security Advisory
Aug 24, 2026 Security Advisory
Aug 24, 2026 Security Advisory
Aug 24, 2026 Security Advisory

References

https://access.redhat.com/errata/RHSA-2026:50931 advisory
https://access.redhat.com/security/cve/CVE-2026-13149 advisory
https://access.redhat.com/security/cve/CVE-2026-15927 advisory
https://access.redhat.com/security/cve/CVE-2026-39822 advisory
https://access.redhat.com/security/cve/CVE-2026-42504 advisory
https://access.redhat.com/security/cve/CVE-2026-54058 advisory
https://access.redhat.com/security/cve/CVE-2026-54060 advisory
https://access.redhat.com/security/cve/CVE-2026-55379 advisory
https://access.redhat.com/security/cve/CVE-2026-55380 advisory
https://access.redhat.com/security/cve/CVE-2026-57231 advisory
https://access.redhat.com/security/cve/CVE-2026-59197 advisory
https://access.redhat.com/security/cve/CVE-2026-59199 advisory
https://access.redhat.com/security/cve/CVE-2026-59200 advisory
https://access.redhat.com/security/cve/CVE-2026-59204 advisory
https://access.redhat.com/security/cve/CVE-2026-59205 advisory
https://access.redhat.com/security/cve/CVE-2026-59869 advisory
https://access.redhat.com/security/cve/CVE-2026-59885 advisory
https://access.redhat.com/security/cve/CVE-2026-59886 advisory
https://access.redhat.com/security/updates/classification/ advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50931.json advisory

…and 98 more

Open in Interactive Console →