An unauthenticated resource consumption vulnerability in the brace-expansion library allows attackers to trigger a denial of service condition.

This vulnerability is categorized as uncontrolled resource consumption (CWE-400), where the library fails to limit the allocation of resources when processing input, allowing an unauthenticated attacker to exhaust system memory or CPU.

By inducing high resource consumption, an attacker can effectively perform a denial of service attack, causing the application to hang or crash. The CVSS score of 7.5 reflects the high impact on availability, which can lead to significant service degradation for dependent applications.

Immediate Action: Update the brace-expansion library to the latest safe version (1.1.18, 2.1.4, 3.0.6, or 5.0.9) to ensure resource limits are properly enforced.

Proactive Monitoring: Monitor server memory and CPU utilization for anomalous spikes that correlate with incoming network traffic.

Compensating Controls: Implement strict input validation or size limits on any data passed to the brace-expansion utility to prevent the processing of malicious payloads.

Public Exploit Available: Unknown

Security teams should immediately identify and update all instances of the brace-expansion library within their software supply chain. Because a proof-of-concept exists, the risk of exploitation is elevated and prompt remediation is required to maintain system stability.