This advisory addresses two vulnerabilities in the Red Hat Hardened Images RPMs, particularly the grafana13.1 package. CVE-2026-69152 is a denial of service vulnerability caused by the brace-expansion library's expand() function failing to enforce length restrictions on intermediate arrays, allowing attackers to exhaust system memory or block the event loop. This issue bypasses a prior mitigation for CVE-2026-14257. The advisory references updated RPM packages grafana13.1-13.1.1-0.5.1.hum1 for aarch64 and x86_64 architectures. No CVSS score is provided, but Red Hat rates the severity as high. The advisory does not explicitly state fixed affected versions or provide patch links but indicates that updated packages are available.

The primary impact is a denial of service (DoS) condition caused by resource exhaustion (memory and event loop blocking) due to unbounded intermediate arrays in the brace-expansion library. This can disrupt availability of affected systems running the vulnerable grafana13.1 package. No confidentiality or integrity impact is reported. There are no known exploits in the wild at this time.

Red Hat has released updated RPM packages (grafana13.1-13.1.1-0.5.1.hum1) to address these vulnerabilities. Users should apply these updates as soon as possible to remediate the issue. Since this is not a cloud service, remediation depends on applying the vendor-provided package updates. Patch status is confirmed by the vendor advisory. No additional mitigations or workarounds are specified.