Skip to content
Heist/ feed
Back to feed
Unrated

CVE-2026-102276 affecting package python-tensorboard 2.16.2-6

Type: advisorySources: OSV

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Products
python-tensorboard
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-102276
Confirmed fixed CVEs
Not specified
Updated in this feed
30 Oct 2026, 14:03 UTC · Revision 1

Source evidence

CVE-2026-102276 affecting package python-tensorboard 2.16.2-6

core-osv · Original source

Published 28 Sept 2026, 21:17 UTC

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

osv:AZL-105248

python-tensorboard

Fixed versions: Not specified

Complete source record
{
  "id": "eacd4639818e6f1de083bfa07d9ee91b51537bd0deb1caec5bf96b7bce2aa218",
  "url": "https://osv.dev/vulnerability/AZL-105248",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2026-102276 affecting package python-tensorboard 2.16.2-6",
    "summary": "The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.",
    "evidence": "osv:AZL-105248",
    "products": [
      {
        "name": {
          "value": "python-tensorboard",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "AZL-105248",
      "aliases": [
        "AZL-105248"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "2.16.2-6"
                }
              ]
            }
          ],
          "package": {
            "name": "python-tensorboard",
            "purl": "pkg:rpm/azure-linux/python-tensorboard",
            "ecosystem": "Azure Linux:3"
          },
          "database_specific": {
            "source": "https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-105248.json"
          }
        }
      ],
      "modified": "2026-10-15T05:37:09Z",
      "provider": "osv",
      "upstream": [
        "CVE-2026-102276"
      ],
      "references": [
        "https://nvd.nist.gov/vuln/detail/CVE-2026-102276"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2026-102276",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 321286,
  "published_at": "2026-09-28T21:17:16+00:00"
}