RHSA-2026:52968 | Vulnetix

RHSA-2026:52968 PUBLISHED CVSS 8.199999809265137 HIGH

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.

Risk Scores

CVSS 3.1

8.199999809265137

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Affected Products

Vendor	Product	Versions
Red Hat	registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:98f38a284e1063c5faf226f8419a0259468b417117e923c602ef824c5acde59f_s390x as a component of Red Hat Quay 3.12	, , *
Red Hat	registry.redhat.io/quay/quay-rhel8@sha256:070e847ec43b0701f20ca5c4caf0e3f910a3693ffe1de52025bd718d01e4f3a2_s390x as a component of Red Hat Quay 3.12	, , *
Red Hat	registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:7622cccef3f39c08be99c6b8e28fabe0fc5e3abe8760a13c786d85de2262dbf3_amd64 as a component of Red Hat Quay 3.12	, , *
Red Hat	registry.redhat.io/quay/clair-rhel8@sha256:557e7101259e79eab5cd1a4a610a5ab8880e12f98d28acccdc31b0be9b0ce1b9_ppc64le as a component of Red Hat Quay 3.12	, , *
Red Hat	registry.redhat.io/quay/quay-operator-bundle@sha256:ae2f8a2572f05ee980f90290779768eb0d91d265b5d66bfbd09aea0973e075c8_amd64 as a component of Red Hat Quay 3.12	, , *
Red Hat	registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:43b159edb0c7f87ed1b5a66dc29ecb2df49e48ea5a2b44c723d55e34252ae693_ppc64le as a component of Red Hat Quay 3.12	, , *
Red Hat	registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:9f6750e66e32e304a428a246ce3f93ccce6e216445c9cb15407c7161b67c0bc2_amd64 as a component of Red Hat Quay 3.12	, , *
Red Hat	registry.redhat.io/quay/quay-operator-rhel8@sha256:36897c430fc5f5dfd8ef5db3aedcf5122955b492c3adb2849c375266a2efa65c_amd64 as a component of Red Hat Quay 3.12	, , *
Red Hat	registry.redhat.io/quay/quay-builder-rhel8@sha256:f645ea22c97a0ff14b4e03a895c42af63efa3602d22c56b553502008907e78ea_amd64 as a component of Red Hat Quay 3.12	, , *
Red Hat	registry.redhat.io/quay/quay-rhel8@sha256:0dd63eccda8c69552dfc04e0607fe1e2f6b1ea872619a1dfb9bc8584b6b1f4a9_ppc64le as a component of Red Hat Quay 3.12	, , *
Red Hat	registry.redhat.io/quay/quay-operator-rhel8@sha256:0729b617a3b83bf3dd2eb7a6e0de1532f096ac39e6c4c82f027fb7267271f872_arm64 as a component of Red Hat Quay 3.12	, , *
Red Hat	registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:72910eeeadea17d1eb4f01a8283c9cbd5a2154697b7e3272247795f06a02ee72_arm64 as a component of Red Hat Quay 3.12	, , *
Red Hat	registry.redhat.io/quay/quay-builder-rhel8@sha256:3a326100aac414e5f8a763ffb90078847670983630fa2ebff143ec1e9e156795_s390x as a component of Red Hat Quay 3.12	, , *
Red Hat	registry.redhat.io/quay/quay-rhel8@sha256:15a7bbee76c4c5501b70e2cec051440468792c6386e690be27630afc0f3e27ef_arm64 as a component of Red Hat Quay 3.12	, , *
Red Hat	registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:dc65635f203b36787518b39b7fd8317434fe24cf5d046fb3e2c012543e3b14bf_arm64 as a component of Red Hat Quay 3.12	, , *
Red Hat	registry.redhat.io/quay/quay-builder-rhel8@sha256:0e6c92bf4b91c52500ddf299e5714b2ba1e73ad9410656691247addbf3be14f2_ppc64le as a component of Red Hat Quay 3.12	, , *
Red Hat	registry.redhat.io/quay/clair-rhel8@sha256:4c6e65b4777714412744e32d2ad21ee01b80b924426588191cbbe9eaf4800175_arm64 as a component of Red Hat Quay 3.12	, , *
Red Hat	Red Hat Quay
Red Hat	registry.redhat.io/quay/quay-operator-rhel8@sha256:361d838ebf83dea3d3075155dec1a645809126fef6ddf48ecb61296b3f8ab05e_ppc64le as a component of Red Hat Quay 3.12	, , *
Red Hat	registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8b1b2b7399840440da8e97e9f9faf86eeb700bbc96fd617b0703556d86eef777_s390x as a component of Red Hat Quay 3.12	, , *

…and 9 more

Timeline

Aug 10, 2026 CVE Published
Sep 18, 2026 CVE Updated
Sep 18, 2026 Distribution Patch
Sep 18, 2026 Distribution Patch
Sep 18, 2026 Security Advisory
Sep 18, 2026 Security Advisory
Sep 18, 2026 Security Advisory
Sep 18, 2026 Security Advisory
Sep 18, 2026 Security Advisory
Sep 18, 2026 Security Advisory
Sep 18, 2026 Security Advisory
Sep 18, 2026 Security Advisory

References

https://access.redhat.com/errata/RHSA-2026:52968 advisory
https://access.redhat.com/security/cve/CVE-2026-13149 advisory
https://access.redhat.com/security/cve/CVE-2026-15927 advisory
https://access.redhat.com/security/cve/CVE-2026-39822 advisory
https://access.redhat.com/security/cve/CVE-2026-42504 advisory
https://access.redhat.com/security/cve/CVE-2026-54058 advisory
https://access.redhat.com/security/cve/CVE-2026-54060 advisory
https://access.redhat.com/security/cve/CVE-2026-55379 advisory
https://access.redhat.com/security/cve/CVE-2026-55380 advisory
https://access.redhat.com/security/cve/CVE-2026-57231 advisory
https://access.redhat.com/security/cve/CVE-2026-59197 advisory
https://access.redhat.com/security/cve/CVE-2026-59199 advisory
https://access.redhat.com/security/cve/CVE-2026-59200 advisory
https://access.redhat.com/security/cve/CVE-2026-59204 advisory
https://access.redhat.com/security/cve/CVE-2026-59205 advisory
https://access.redhat.com/security/cve/CVE-2026-59869 advisory
https://access.redhat.com/security/cve/CVE-2026-59885 advisory
https://access.redhat.com/security/cve/CVE-2026-59886 advisory
https://access.redhat.com/security/updates/classification/ advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52968.json advisory

…and 98 more

Open in Interactive Console →