Executive Summary

The vulnerability CVE-2026-45149 affects the brace-expansion library versions 5.0.0 to 5.0.5. It occurs because the 'max' option, which is supposed to limit the number of expanded items, is applied too late during the expansion of large numeric ranges like {1..10000000}.

As a result, the library generates all intermediate elements in the sequence (e.g., all 10 million numbers) before applying the limit, causing excessive memory allocation (~505 MB) and processing time (~800ms), even if the final output is limited to a smaller number of items.

This inefficiency can lead to performance degradation and high resource consumption. The issue was fixed in version 5.0.6.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing high memory usage and increased processing time when expanding large numeric ranges using the brace-expansion library.

Even if the output is limited to a small number of items, the system still allocates significant memory (around 505 MB) and spends considerable time (approximately 800ms) generating all intermediate elements.

This can lead to reduced availability of the affected system or application due to resource exhaustion, potentially causing slowdowns or crashes.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring the usage of the brace-expansion library versions 5.0.0 to 5.0.5 in your environment, especially when expanding large numeric ranges such as {1..10000000}.

Detection can involve checking for unusually high memory usage (~505 MB) and processing delays (~800ms) during brace-expansion operations with large ranges.

A practical approach is to identify scripts or applications that use brace-expansion with large numeric ranges and test expansions with the max option set, observing resource consumption.

Specific commands are not provided in the resources, but you can use system monitoring tools like 'top', 'htop', or 'ps' on Linux to observe memory and CPU usage during brace-expansion operations.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the brace-expansion library to version 5.0.6 or later, where this vulnerability is fixed.

As a workaround, ensure that input strings do not exceed the desired maximum item count before expansion to avoid generating large intermediate arrays.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0