VDB
RHSA-2026:57367
RHSA-2026:57367
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand() function, which can lead to excessive memory consumption. This can cause a denial of service (DoS) by crashing the application due to an out-of-memory error.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:617fb2eca337c17306e22e90279d24039f599d842c1f7fcd8f4b22233cabe5c2_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9@sha256:a1046d41415522e2706a3f4743d104dd5b8ea7da2b6aba390bc07b9d47c3a39f_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9@sha256:528d38df803e665523f72657c8ff9bea582bfa5c78424b58c5c468a649313d9c_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:aa4804e36f274ca26bb44b0e0493d9ceb667dcfc61ffc70c6a70f1bceff1b00a_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:7a734abb043d5525ecb19d97eafccceecd50ad459f4f116929e955dff979908e_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-dpu-daemon-rhel9@sha256:fb78c75612260bd7020f3269bba488fd94abbb25654fe21135b9cb4464facd92_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-ptp-rhel9-operator@sha256:50bf586dec4baf18b1cc45c5392bcd7128bae2c26d3c701f3a77cda56c892255_ppc64le as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel9@sha256:c2c679d6ccfe38e7e6eaa3959009dd37e5713d96c800234c441072ee6b5b7516_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-dpu-intel-netsec-vsp-rhel9@sha256:b68c163be1047290541cc835ea05b49a4c5fcc36dad3759bdcefefbe4ad0a686_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-local-storage-mustgather-rhel9@sha256:e1dd3bd2200e1e7f313167160e94eedd392ee4ed501a73bc8d3030ee81589136_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/metallb-rhel9@sha256:1fbd8677d4066aab17f2fa43be55e9f604ca9960ef7513e191b3684b8bad92fd_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel9@sha256:65e3dcdcb1fcf7f04e7362e9095bdf10e1747d64ff70205fb068c24edd81dff6_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-support-log-gather-rhel9-operator@sha256:3e29ec38a52e53fa82c1b47562d56a4dbdfac883ed3ca2d73bbcdea5a1a9c818_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:ed7f11b9ccc1f7d85f08683eed769f40cef4d62c5e3890de83ff6678ffc8eee4_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:3c4df8a2133ef072ce9e731ff817eff63873827f405f6358d1c2953c11ebeefe_amd64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9@sha256:0c8de0f207ab7e4e731859b2ce0ddfd0cab5c78ff86e02e5e942fd4069eda18d_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/pf-status-relay-rhel9-operator@sha256:46f36b92539b91f61b770f63af923e308575ab849d30bc9a16fc340be7fda724_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:e10d8b1dbdf982db832941ccfdb40196b3e876153277d40249135adad344f008_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-local-storage-mustgather-rhel9@sha256:3d91475d8d3d64f54be0b2d6167846378d25008b093fa662a82869eede930707_s390x as a component of Red Hat OpenShift Container Platform 4.22 | * |
| Red Hat | registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9@sha256:1cb1a1f1281731af642932995b6148856f998ae3e8acd8d8ddb240890bd81b5a_arm64 as a component of Red Hat OpenShift Container Platform 4.22 | * |
…and 174 more
Timeline
- Aug 25, 2026 CVE Published
- Sep 1, 2026 CVE Updated
- Sep 1, 2026 Distribution Patch
- Sep 1, 2026 Distribution Patch
- Sep 1, 2026 Security Advisory
- Sep 1, 2026 Security Advisory
- Sep 1, 2026 Security Advisory
- Sep 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:57367 advisory
- https://access.redhat.com/security/cve/CVE-2026-14257 advisory
- https://access.redhat.com/security/cve/CVE-2026-33814 advisory
- https://access.redhat.com/security/cve/CVE-2026-69152 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57367.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2506433 issue
- https://www.cve.org/CVERecord?id=CVE-2026-14257 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-14257 advisory
- https://github.com/juliangruber/brace-expansion advisory
- https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5 advisory
- https://www.npmjs.com/package/brace-expansion advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467815 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33814 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33814 advisory
- https://go.dev/cl/761581 advisory
- https://go.dev/cl/761640 advisory
- https://go.dev/issue/78476 advisory
- https://groups.google.com/g/golang-announce/c/qcCIEXso47M advisory
- https://pkg.go.dev/vuln/GO-2026-4918 advisory
…and 8 more