bnbdr

brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or tra