What is CVE-2026-14257?
CVE-2026-14257 affects brace-expansion through version 5.0.7, allowing denial of service via memory exhaustion. The `expand()` function does not bound the length of each result string, enabling an attacker to exhaust memory by chaining multiple brace groups. Users should update to the latest patched version.
Azərbaycanca: CVE-2026-14257 brace-expansion kitabxanasının 5.0.7 versiyasına qədər olan versiyalarına təsir edən zəiflikdir. `expand()` funksiyası uzun nəticə sətirləri yaradaraq memory exhaustion vasitəsilə denial of service hücumuna şərait yaradır. Kitabxananı ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-400
FAQ2
How does CVE-2026-14257 affect the brace-expansion library?
It allows denial of service via memory exhaustion by generating very long result strings through the `expand()` function.
How can this vulnerability be mitigated?
Users should update the brace-expansion library to the latest patched version.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.