VDB
RHSA-2026:61721
RHSA-2026:61721
PUBLISHED
CVSS 8.600000381469727 HIGH
A flaw was found in the brace-expansion library. The `expand()` function does not apply `maxLength` when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is due to an incomplete mitigation of CVE-2026-14257.
Risk Scores
CVSS 3.1
8.600000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:8de2810bb50af658ce3dd3b5a83bcc11bea738da6b1aeb637501e26b6522ca25_amd64 as a component of Red Hat Developer Hub 1.10 | * |
| Red Hat | registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:96846b52574b28705e69ffcf4989780852535526a7859adc28f9842d83f50a92_amd64 as a component of Red Hat Developer Hub 1.10 | * |
| Red Hat | registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ec7c7c800a638cc921df413df3e43fc3e7e41d4b304d519ff3393ecc1c8eb174_amd64 as a component of Red Hat Developer Hub 1.10 | * |
| Red Hat | registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:abd10cdcc70ca710d0c18baa0913792100eeb8d8554c1359ed1a29d2ba3f8c77_amd64 as a component of Red Hat Developer Hub 1.10 | * |
| Red Hat | registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:38075c2bb77292114b40feab48aa875a9e03f4d9940c2e67d1fe05badaece7b4_amd64 as a component of Red Hat Developer Hub 1.10 | * |
| Red Hat | registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:b7558e8f25c8ae3f5076b415cfb7fa5ae07a992d54760b85a67732ee17adb896_amd64 as a component of Red Hat Developer Hub 1.10 | * |
| Red Hat | registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:357988e253b0a3b0ff8d3b77dc5886366faaebbd58e9695e1d7fb325dcd008c5_amd64 as a component of Red Hat Developer Hub 1.10 | * |
Timeline
- Aug 31, 2026 CVE Published
- Oct 1, 2026 CVE Updated
- Oct 1, 2026 Distribution Patch
- Oct 1, 2026 Distribution Patch
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:61721 advisory
- https://access.redhat.com/security/cve/CVE-2026-69152 advisory
- https://access.redhat.com/security/cve/CVE-2026-69192 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://catalog.redhat.com/search?gs&searchType=containers&q=rhdh advisory
- https://developers.redhat.com/rhdh/overview advisory
- https://docs.redhat.com/en/documentation/red_hat_developer_hub advisory
- https://redhat.atlassian.net/browse/RHIDP-15975 advisory
- https://redhat.atlassian.net/browse/RHIDP-15976 advisory
- https://redhat.atlassian.net/browse/RHIDP-15977 advisory
- https://redhat.atlassian.net/browse/RHIDP-15978 advisory
- https://redhat.atlassian.net/browse/RHIDP-15979 advisory
- https://redhat.atlassian.net/browse/RHIDP-15980 advisory
- https://redhat.atlassian.net/browse/RHIDP-15983 advisory
- https://redhat.atlassian.net/browse/RHIDP-15984 advisory
- https://redhat.atlassian.net/browse/RHIDP-15985 advisory
- https://redhat.atlassian.net/browse/RHIDP-15986 advisory
- https://redhat.atlassian.net/browse/RHIDP-15987 advisory
- https://redhat.atlassian.net/browse/RHIDP-15988 advisory
- https://redhat.atlassian.net/browse/RHIDP-15989 advisory
…and 16 more