Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-26042

Date: March 16, 2025

Uptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. If a string is provided it triggers catastrophic backtracking in the regular expression, leading to a ReDoS attack.

Severity Score

Related Resources (9)

https://github.com/louislam/uptime-kuma/issues/5574
https://github.com/louislam/uptime-kuma/commit/7a9191761dbef6551c2a0aa6eed5f693ba48d688
https://github.com/louislam/uptime-kuma/pull/5573
https://github.com/louislam/uptime-kuma
https://github.com/louislam/uptime-kuma/security/advisories/GHSA-hx7h-9vf7-5xhg
https://gist.github.com/ShiyuBanzhou/bf4cee61603e152c114fa8c4791f9f28
https://nvd.nist.gov/vuln/detail/CVE-2025-26042
https://gist.github.com/ShiyuBanzhou/26c918f93b07f5ce90e8f7000d29c7a0
https://www.mend.io/vulnerability-database/CVE-2025-26042

Severity Score

Weakness Type (CWE)

Inefficient Regular Expression Complexity

CWE-1333

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): HIGH
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): HIGH
Availability (A): HIGH

Do you need more information?

Contact Us