CVE-2026-33750 Details
Description
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.
A denial-of-service vulnerability has been identified in the brace-expansion library, affecting versions prior to 5.0.5, as well as 3.0.2, 2.0.3, and 1.1.13. The issue arises when a brace pattern with a zero step value, such as '{1..2..0}', is used. This causes the sequence generation loop to run indefinitely, leading to a process hang of several seconds and excessive memory allocation. The vulnerability can be exploited by passing untrusted strings to the 'expand()' function' or inadvertently setting a step value of zero. This behavior is particularly problematic in applications that use minimatch or glob patterns sourced from command-line arguments or configuration files.
Users can upgrade to brace-expansion versions 5.0.5, 3.0.2, 2.0.3, or 1.1.13, all of which include the necessary fix. After updating, it's recommended to sanitize any strings passed to the 'expand()' function' to ensure that a zero step value is not used.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| juliangruber brace-expansion | < 1.1.13 >= 2.0.0, < 2.0.3 >= 3.0.0, < 3.0.2 >= 5.0.0, < 5.0.5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | Initial Analysis | [email protected] |
| Mar 27, 2026 | New CVE Received | [email protected] |