CVE-2026-33750: brace-expansion: Zero-step sequence causes process hang and memory exhaustion

Overview

Severity

Medium (CVSS 6.5)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploit Status

Not Exploited

Patch Tuesday

2026-Mar

Released

2026-03-31

Last Updated

2026-09-25

EPSS Score

0.61% (percentile: 47.3%)

Affected Products (4)

Open Source Software

• cbl2 nodejs18 18.20.3-11 on CBL Mariner 2.0
• cbl2 reaper 3.1.1-22 on CBL Mariner 2.0

Other

• 21130-17086
• 20776-21692

Revision History

• 2026-03-31: Information published.
• 2026-03-31: Information published.
• 2026-04-01: Information published.
• 2026-04-02: Information published.
• 2026-04-22: Information published.
• 2026-04-23: Information published.
• 2026-09-25: Information published.