CVE-2026-45149 is a denial of service vulnerability in the brace-expansion library affecting Red Hat Hardened Images RPMs versions 5.0.0 through 5.0.5. The vulnerability arises because the library allocates excessive memory when expanding large numeric ranges before applying any maximum limit, resulting in high memory consumption and potential application crashes. Red Hat products shipping brace-expansion versions 1.x and 2.x are not affected. The issue is tracked under CWE-770 (Allocation of Resources Without Limits or Throttling). A security update including fixed RPMs is available from Red Hat.

An attacker can exploit this vulnerability by supplying a large numeric range for brace expansion, causing excessive memory allocation and potentially crashing applications or systems using the affected library. This leads to a denial of service condition impacting system availability. There is no impact on confidentiality or integrity. No known exploits are reported in the wild.

A patch is available from Red Hat to fix this vulnerability in affected versions 5.0.0 through 5.0.5 of the brace-expansion library included in Red Hat Hardened Images RPMs. Users should apply the update as provided by Red Hat. No effective mitigations meeting Red Hat's criteria are currently available other than applying the official fix.