VDB
RHSA-2026:53520
RHSA-2026:53520
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:5ce39e31a69193bac6b30b61f0c5731fdc57740071c642e53f57be2eae9fa979_amd64 as a component of Red Hat Quay 3.10 | * |
| Red Hat | Red Hat Quay | |
| Red Hat | registry.redhat.io/quay/quay-builder-rhel8@sha256:42fc54dce8bc2ccfaa992560a4893248b449f8bd0fe58f2ed71a407f16518c26_ppc64le as a component of Red Hat Quay 3.10 | * |
| Red Hat | registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:5b566b025d232e63ee8bbc6768c5c27aa0dc4760362aca1e82b588d61ff06f0f_amd64 as a component of Red Hat Quay 3.1 | * |
| Red Hat | registry.redhat.io/quay/quay-operator-rhel8@sha256:377c751454d9edf35778cbf738b4fb44aed9ef046fe4259efec77535ed3c29f5_amd64 as a component of Red Hat Quay 3.10 | * |
| Red Hat | registry.redhat.io/quay/clair-rhel8@sha256:f58bdb68a2cca947dcd330bbfbc9d2ef5e9d0015eded00f74856345b6a962962_s390x as a component of Red Hat Quay 3.1 | * |
| Red Hat | registry.redhat.io/quay/quay-rhel8@sha256:967c0ce73afdafe4fe21dc196bc938864b437f6a3c3af99b8247abfe4535b395_amd64 as a component of Red Hat Quay 3.1 | * |
| Red Hat | registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2f42892b36358ff044d9f0542f207837ae3c1f1d021e9906489ffe04aaeda493_ppc64le as a component of Red Hat Quay 3.1 | * |
| Red Hat | registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f1728933739482fa3838501620a8386f29c85fe01e35e8ef6aa952d454143a1b_ppc64le as a component of Red Hat Quay 3.10 | * |
| Red Hat | registry.redhat.io/quay/quay-operator-rhel8@sha256:377c751454d9edf35778cbf738b4fb44aed9ef046fe4259efec77535ed3c29f5_amd64 as a component of Red Hat Quay 3.1 | * |
| Red Hat | registry.redhat.io/quay/quay-operator-bundle@sha256:42395aa2236cdfbaa5396e6d81559506dfe122159c67bc37aba15ab9cb584ee0_amd64 as a component of Red Hat Quay 3.1 | * |
| Red Hat | registry.redhat.io/quay/quay-operator-bundle@sha256:42395aa2236cdfbaa5396e6d81559506dfe122159c67bc37aba15ab9cb584ee0_amd64 as a component of Red Hat Quay 3.10 | * |
| Red Hat | registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:f892742e326b7434c6430f1eef16412143b7798954eedd49b946f0f78323dccc_amd64 as a component of Red Hat Quay 3.10 | * |
| Red Hat | registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:f0bff8e6bbe9eb4cb03dc3ccc09325d64988a81dd31d1b468462f3feb0a41e02_amd64 as a component of Red Hat Quay 3.10 | * |
| Red Hat | registry.redhat.io/quay/quay-builder-rhel8@sha256:467a021912c1193ef407d4a8183f4c686e15158e581cf21350fa12cd94d32296_s390x as a component of Red Hat Quay 3.10 | * |
| Red Hat | registry.redhat.io/quay/clair-rhel8@sha256:a34629c7545fcb9fcc3ab9cb641eb5c8ebb6296a1d3fdaa73db75b6f236d9a18_amd64 as a component of Red Hat Quay 3.10 | * |
| Red Hat | registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:2f42892b36358ff044d9f0542f207837ae3c1f1d021e9906489ffe04aaeda493_ppc64le as a component of Red Hat Quay 3.10 | * |
| Red Hat | registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c4c0ae660f538767064ca9a2a98003e60b6960e5290d5d70d95e9913958b890_s390x as a component of Red Hat Quay 3.10 | * |
| Red Hat | registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:66ece0a989503dfa46045c70c8f8937775b3dc7324fbcbfcbc68c940b882a708_amd64 as a component of Red Hat Quay 3.1 | * |
| Red Hat | registry.redhat.io/quay/clair-rhel8@sha256:18b2bce956cfc6f6fbcd58be41b3a4ed9429336bd5d7c4b100f267b90a207c8e_ppc64le as a component of Red Hat Quay 3.1 | * |
…and 25 more
Timeline
- Aug 11, 2026 CVE Published
- Sep 18, 2026 CVE Updated
- Sep 18, 2026 Distribution Patch
- Sep 18, 2026 Distribution Patch
- Sep 18, 2026 Security Advisory
- Sep 18, 2026 Security Advisory
- Sep 18, 2026 Security Advisory
- Sep 18, 2026 Security Advisory
- Sep 18, 2026 Security Advisory
- Sep 18, 2026 Security Advisory
- Sep 18, 2026 Security Advisory
- Sep 18, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:53520 advisory
- https://access.redhat.com/security/cve/CVE-2026-13149 advisory
- https://access.redhat.com/security/cve/CVE-2026-15927 advisory
- https://access.redhat.com/security/cve/CVE-2026-39822 advisory
- https://access.redhat.com/security/cve/CVE-2026-42504 advisory
- https://access.redhat.com/security/cve/CVE-2026-54058 advisory
- https://access.redhat.com/security/cve/CVE-2026-54060 advisory
- https://access.redhat.com/security/cve/CVE-2026-55379 advisory
- https://access.redhat.com/security/cve/CVE-2026-55380 advisory
- https://access.redhat.com/security/cve/CVE-2026-57231 advisory
- https://access.redhat.com/security/cve/CVE-2026-59197 advisory
- https://access.redhat.com/security/cve/CVE-2026-59199 advisory
- https://access.redhat.com/security/cve/CVE-2026-59200 advisory
- https://access.redhat.com/security/cve/CVE-2026-59204 advisory
- https://access.redhat.com/security/cve/CVE-2026-59205 advisory
- https://access.redhat.com/security/cve/CVE-2026-59869 advisory
- https://access.redhat.com/security/cve/CVE-2026-59885 advisory
- https://access.redhat.com/security/cve/CVE-2026-59886 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53520.json advisory
…and 98 more