https://vulnerability.circl.lu/sightings/feed 2026-08-04T20:55:13.514407+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/8f376fee-bdd1-42c5-a98a-fbcb4db0e530/export 2026-08-04T20:55:13.544456+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "8f376fee-bdd1-42c5-a98a-fbcb4db0e530", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69152", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117037977349070761", "content": "Some increased actor activities are shown targeting juliangruber brace-expansion (CVE-2026-69152) https://vuldb.com/vuln/385629/cti", "creation_timestamp": "2026-08-04T15:36:49.248351Z"} 2026-08-04T15:36:49.248351+00:00 https://vulnerability.circl.lu/sighting/c5c322af-7348-4af8-b118-c6df65c85026/export 2026-08-04T20:55:13.547470+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "c5c322af-7348-4af8-b118-c6df65c85026", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69152", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3msaxo2gbwq2g", "content": "\n\ud83d\udea8 New HIGH CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-69152 impacts brace-expansion in 3 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/640\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-08-04T12:00:52.897369Z"} 2026-08-04T12:00:52.897369+00:00 https://vulnerability.circl.lu/sighting/d92407fb-3033-4810-97c9-c4cf3383759f/export 2026-08-04T20:55:13.547676+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "d92407fb-3033-4810-97c9-c4cf3383759f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69152", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/hlxnpa6jl7kfg", "content": "CVE-2026-69152 - brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation\nCVE ID : CVE-2026-69152\n \n Published : Aug. 3, 2026, 5:16 p.m. | 41\u00a0minutes ago\n \n Description : The brace-expansion library generates arbitrary strings containing ...", "creation_timestamp": "2026-08-03T18:26:13.143396Z"} 2026-08-03T18:26:13.143396+00:00 https://vulnerability.circl.lu/sighting/734c6ca3-30ea-4949-adb7-2f12ab232774/export 2026-08-04T20:55:13.547845+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "734c6ca3-30ea-4949-adb7-2f12ab232774", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69152", "type": "seen", "source": "https://gist.github.com/alon710/d80e5d80b7549449b84a63552411d4ec", "content": "# CVE-2026-69152: CVE-2026-69152: Denial of Service via Resource Exhaustion in brace-expansion\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69152\n\n## Summary\nCVE-2026-69152 is a high-severity Denial of Service (DoS) vulnerability in brace-expansion that allows remote, unauthenticated attackers to cause a process crash or infinite thread-blocking condition. The vulnerability stems from a complete mitigation bypass of the security checks implemented for CVE-2026-14257.\n\n## TL;DR\nA resource exhaustion vulnerability in the brace-expansion library permits unauthenticated remote attackers to trigger process termination via heap memory exhaustion or lock the Node.js event loop by supplying crafted nested brace structures.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400, CWE-770\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5\n- **EPSS Score**: Not available\n- **Impact**: Denial of Service (Availability)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Node.js applications using brace-expansion package\n- **brace-expansion**: < 1.1.18 (Fixed in: `1.1.18`)\n- **brace-expansion**: >= 2.0.0, < 2.1.4 (Fixed in: `2.1.4`)\n- **brace-expansion**: >= 3.0.0, < 3.0.6 (Fixed in: `3.0.6`)\n- **brace-expansion**: >= 4.0.0, < 5.0.9 (Fixed in: `5.0.9`)\n\n## Mitigation\n\n- Limit input length before passing to brace-expansion\n- Sandbox execution within isolated threads or workers\n- Upgrade brace-expansion to patched versions\n\n**Remediation Steps:**\n1. Verify brace-expansion version in package-lock.json\n2. Update dependencies using npm update brace-expansion or yarn upgrade brace-expansion\n3. Incorporate length checks on untrusted inputs before expansion parsing.\n\n## References\n\n- [v1.x Line Fix Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n- [v3.x Line Fix Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [v5.x Line Fix Commit A](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [v5.x Line Fix Commit B](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69152) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-03T17:31:36.975302Z"} 2026-08-03T17:31:36.975302+00:00