Memory Exhaustion in Brace Expansion Library

Executive Summary

The brace-expansion library generates strings with a common prefix and suffix. Before versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9, the expand() function did not enforce memory limits while creating intermediate arrays or padded sequences. This allowed attackers to input data that could exhaust system memory or block the event loop by triggering excessive memory usage.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is in the brace-expansion library versions before 1.1.18, 2.1.4, 3.0.6, and 5.0.9. To detect it, check the installed version of the library using commands like 'npm list brace-expansion' for Node.js or 'pip show brace-expansion' for Python. If the version is below the patched releases, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to denial-of-service conditions by consuming excessive memory or freezing the application's event loop. Systems using vulnerable versions of brace-expansion may become unresponsive or crash when processing crafted input.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt system availability. Memory exhaustion or event loop blocking may lead to service unavailability, violating availability requirements in both regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update the brace-expansion library to versions 1.1.18, 2.1.4, 3.0.6, or 5.0.9 or later to address the vulnerability.

Useful 0 Not Useful 0