PT-2025-11539 · Unknown · Uptime Kuma

Published 2025-03-17 · Updated 2025-03-31 · CVE-2025-26042

Positive Technologies (AI Summary)

CVSS v4.0

6.7

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions Uptime Kuma versions 1.23.0 and later

Description The issue is related to a ReDoS vulnerability that occurs when an administrator creates a notification through the web service. This happens because a provided string triggers catastrophic backtracking in the regular expression, leading to a ReDoS attack.

Recommendations For Uptime Kuma versions 1.23.0 and later, consider restricting the creation of notifications through the web service until a fix is available. As a temporary workaround, limit the input strings that can be used when creating notifications to prevent triggering the ReDoS vulnerability.

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2025-26042

GHSA-3RW8-4XRQ-3F7P

GHSA-HX7H-9VF7-5XHG

Affected Products

Uptime Kuma

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2025-26042 · Security Note
• https://osv.dev/vulnerability/GHSA-hx7h-9vf7-5xhg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-26042 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3rw8-4xrq-3f7p · Vendor Advisory
• https://github.com/louislam/uptime-kuma · Note
• https://github.com/louislam/uptime-kuma/issues/5574 · Note
• https://github.com/louislam/uptime-kuma/pull/5573 · Note
• https://github.com/louislam/uptime-kuma/commit/7a9191761dbef6551c2a0aa6eed5f693ba48d688 · Note
• https://github.com/louislam/uptime-kuma/security/advisories/GHSA-hx7h-9vf7-5xhg · Note
• https://t.me/cvedetector/20503 · Telegram Post
• https://twitter.com/CVEnew/status/1901708611593842970 · Twitter Post
• https://gist.github.com/ShiyuBanzhou/26c918f93b07f5ce90e8f7000d29c7a0 · Note
• https://gist.github.com/ShiyuBanzhou/bf4cee61603e152c114fa8c4791f9f28 · Note
• https://t.me/cvetracker/19310 · Telegram Post