Detections
Analytics

CVE-2025-26042

medium

Description

Uptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. If a string is provided it triggers catastrophic backtracking in the regular expression, leading to a ReDoS attack.

References

https://github.com/louislam/uptime-kuma/pull/5573

https://github.com/louislam/uptime-kuma/issues/5574

https://github.com/louislam/uptime-kuma/commit/7a9191761dbef6551c2a0aa6eed5f693ba48d688

Details

Source: Mitre, NVD

Published: 2025-03-17

Updated: 2026-04-15

Risk Information

CVSS v2

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Severity: Medium

CVSS v3

Base Score: 6

Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H

Severity: Medium

CVSS v4

Base Score: 6.7

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L

Severity: Medium

EPSS

EPSS: 0.00034