VDB
RHSA-2026:70588
RHSA-2026:70588
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand() function, which can lead to excessive memory consumption. This can cause a denial of service (DoS) by crashing the application due to an out-of-memory error.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9@sha256:4f1934c11a4b40934ca2f4a1aeb1548c4612223dc6de63d19ef055f0bbb38a72_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-local-storage-rhel9-operator@sha256:c59a803d7a20e1ec862218c64bfc4b2721efafa58f4e348684c8a8f82acdadaa_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-egress-router-rhel9@sha256:28df3926e09dfd6c9d98b4a980494195a08ba8a7a3101ef6f141c77e946b1a22_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:3cc334122d90741fc428ba8c5a671a704f0180c7fca482343a85289e36d9cc88_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:0efe57a33584e75a712800c269e0e9bee1c1824150614a8ed7320b68f337913d_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-node-driver-registrar-rhel9@sha256:353a736eb64311c9a3d19f677e91ba1f22a3b64faf3a83d286509aeb6dd5fef1_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:f666e1326aca4c0a7ec2d99debb4236f8038db45b16018203c16fbad87272c79_s390x as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-local-storage-mustgather-rhel9@sha256:bef59a385746d2aa9ce945ba77c8abe95d9741c960a9ffb8dcaa32312da42228_s390x as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:3a0876380d5f4196c9c33259f314cbccee1be3f5febca48dbd6adc85f0ea2c04_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:bf506fc7d04e8d670ad5661e016a82aaaf9284bd0bf2e6344e9f2bdf76e3763d_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:2fe601eac201a0576bbe6269c8ba7df43a16d34e33038b8d0ac359cc0b5f3fa5_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:4066486a5b755d59b1d136af60cbf8cd521869f72b0e847ebe2ee148a6d9fbf3_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-operator-sdk-rhel9@sha256:e96efc1aea6c6a2799db1cdb429d88a7823a6639f5cf71af403df6cbd938b79a_s390x as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:ed48f011cd7e87029a6998a1f35fe278bae6d61055d038351543e43c5f86d555_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-driver-shared-resource-mustgather-rhel9@sha256:ea563f4f6e5d30e32f5addebe180aee39e1fd1860d850b28d71a191fc549afa5_s390x as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9@sha256:0b0c218ea2c6507ee4ad70a28c01914d626447aee3e0eae933ac319208e1b618_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-smb-csi-driver-rhel9@sha256:920e73d0ec7fd802b1f59511681c548ec5dd1fa60e8f0c637ee950f6ceef223f_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel9@sha256:72f4294ae66927295688ac11d5af17b45024a4dbb03df140bde2a2441c1f6282_s390x as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-smb-csi-driver-rhel9-operator@sha256:a64c51289ee3bf6d3dbefb01430802550a09376540cf24297905e1bd46291264_s390x as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-kubernetes-nmstate-handler-rhel9@sha256:c05c25012b03516787053b3df7735f08bda2276794442768f6d9da21bc37616b_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | * |
…and 171 more
Timeline
- Oct 1, 2026 CVE Published
- Oct 4, 2026 CVE Updated
- Oct 4, 2026 Distribution Patch
- Oct 4, 2026 Distribution Patch
- Oct 4, 2026 Security Advisory
- Oct 4, 2026 Security Advisory
- Oct 4, 2026 Security Advisory
- Oct 4, 2026 Security Advisory
- Oct 4, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:70588 advisory
- https://access.redhat.com/security/cve/CVE-2026-14257 advisory
- https://access.redhat.com/security/cve/CVE-2026-33814 advisory
- https://access.redhat.com/security/cve/CVE-2026-69152 advisory
- https://access.redhat.com/security/cve/CVE-2026-73643 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70588.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2506433 issue
- https://www.cve.org/CVERecord?id=CVE-2026-14257 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-14257 advisory
- https://github.com/juliangruber/brace-expansion advisory
- https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5 advisory
- https://www.npmjs.com/package/brace-expansion advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467815 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33814 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33814 advisory
- https://go.dev/cl/761581 advisory
- https://go.dev/cl/761640 advisory
- https://go.dev/issue/78476 advisory
- https://groups.google.com/g/golang-announce/c/qcCIEXso47M advisory
…and 14 more