VDB

RHSA-2026:59204

RHSA-2026:59204 PUBLISHED CVSS 7.5 HIGH

Record from redhat · Published August 24, 2026

A flaw was found in the brace-expansion library. The `expand()` function does not apply `maxLength` when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is due to an incomplete mitigation of CVE-2026-14257.

Risk scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

VendorProductVersions
Red Hatregistry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel9@sha256:036fb13285e7c0f6f48470e243328409088b0978f44a89938c0b33d8e55f83dc_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11*
Red Hatregistry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel9@sha256:2d92b0195da0efa4289250d62148b2b1fe907b44dca46ba3d416d70da5048a30_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11*
Red Hatregistry.redhat.io/advanced-cluster-security/rhacs-collector-rhel9@sha256:6473da59faebc826bc0eed63d39a0048b33eed635f05249cc173bbb58eac77a4_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11*
Red Hatregistry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-db-rhel9@sha256:8e4260e45a5cb94efa22f2b4b63eec3434df748051236e3c2b872e044e7b1c25_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11*
Red Hatregistry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator@sha256:2a11452e54e489428495c12246e8bffcf4bc87930d349fa12ebd9037fde2253b_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11*
Red Hatregistry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel9@sha256:e672b850612f46a693bb1d8eaf5f02752cb9515c709bd5acdae82f757fe5da13_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11*
Red Hatregistry.redhat.io/advanced-cluster-security/rhacs-fact-rhel9@sha256:ef108eaeaadc14e03a0523eadfb1a99d64898eeabc4c8e7a55496719b7501fb9_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11*
Red Hatregistry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel9@sha256:d9d7776207bcf4ea04fada3316bd62dfa1ebb020858494899d1e88968b011a60_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11*
Red Hatregistry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel9@sha256:9ff667c4d2c22b4591300cf21070affeae2153d94e4c0b7e1f1ee6196b730ef0_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11*
Red Hatregistry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-rhel9@sha256:7073ffdf140285251c95c5ab1448b1458835c8ba720a4ce5d0be79abcf19d69d_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11*
Red Hatregistry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel9@sha256:d485e4e93455c21b7ed75365470cb91d15aedd0b22c9d2e5ba2ac34cf811e76d_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11*
Red Hatregistry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-rhel9@sha256:61c36962d52b4c0a458a25c8b132f04a8138912856d12dc88f53ef818aa94a88_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11*
Red Hatregistry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-db-rhel9@sha256:6e17e504e8422dc69eef8af5401108a2f1523b6a87da4514507e0ba30fa2eb8d_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11*
Red Hatregistry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel9@sha256:758054aebeba5a450ce7e7b6eca8ec6ed7cafd70e02c7d6ae81f5c8e3315007f_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11*
Red Hatregistry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel9@sha256:3274408af0c9c02d0f406eeafb7094092562c9d0b12bd8b05f1521d28b0d160a_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11*
Red Hatregistry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-rhel9@sha256:a69c3134a0ec1417300260acca1847b88422a40cba6cff302eae4628fcfd82d7_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11*
Red Hatregistry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel9@sha256:5f4b442ec8056f49f1c8730f8dc6659a149c27b85db2ead035977d04c62baab2_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11*
Red Hatregistry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator@sha256:92aa6f15eac0876da21a29cfa064283a1786a95c4f17fa7fb3ce168121ce59be_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11*
Red Hatregistry.redhat.io/advanced-cluster-security/rhacs-operator-bundle@sha256:fd9d4f26c7464409ffd491bbadf19d5bbdc767b7a899086c04c18e9d0f87629d_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11*
Red Hatregistry.redhat.io/advanced-cluster-security/rhacs-main-rhel9@sha256:a3ff0d9d28dd9ca914dc632a510d75753ae76ad1e5a3da6b98eec7f469f5d392_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11*

…and 27 more

Timeline

  • Aug 24, 2026 CVE Published
  • Oct 1, 2026 CVE Updated
  • Oct 1, 2026 Distribution Patch (2 in total, the first dated here)
  • Oct 1, 2026 Security Advisory (2 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln RHSA-2026:59204
vulnetix vdb fixes RHSA-2026:59204

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/RHSA-2026%3A59204/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›