rewindex

RewindexCVEsJira

CVE-2025-69873

Low · CVSS 2.9 (CVSS 3.1)EPSS 0.55%, 46th percentilePublished Updated Assigner: mitre

Description

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.

Vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L · CWE-1333

Tracked companies

Jira

Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

ajv.js: ajvRed Hat: Confidential Compute AttestationRed Hat: Cryostat 4Red Hat: Gatekeeper 3Red Hat: Logging Subsystem for Red Hat OpenShiftRed Hat: Multicluster Engine for KubernetesRed Hat: Network Observability OperatorRed Hat: Red Hat Advanced Cluster Management for Kubernetes 2Red Hat: Red Hat Advanced Cluster Security 4Red Hat: Red Hat AMQ Broker 7Red Hat: Red Hat Ansible Automation Platform 2Red Hat: Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat: Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat: Red Hat Ansible Automation Platform 2.6 for RHEL 9Red Hat: Red Hat build of Apache Camel for Spring Boot 4Red Hat: Red Hat build of Apache Camel - HawtIO 4Red Hat: Red Hat build of Apicurio Registry 3Red Hat: Red Hat Build of KeycloakRed Hat: Red Hat Connectivity Link 1Red Hat: Red Hat Data Grid 8Red Hat: Red Hat Directory Server 11Red Hat: Red Hat Directory Server 12Red Hat: Red Hat Directory Server 13Red Hat: Red Hat Enterprise Linux AI (RHEL AI) 3Red Hat: Red Hat Fuse 7Red Hat: Red Hat JBoss Enterprise Application Platform 7Red Hat: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Red Hat: Red Hat JBoss Enterprise Application Platform 8Red Hat: Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat: Red Hat OpenShift AI (RHOAI)Red Hat: Red Hat OpenShift Container Platform 4Red Hat: Red Hat Process Automation 7Red Hat: streams for Apache Kafka 2Red Hat: streams for Apache Kafka 3

References

All CVEsMarkdownJSON