CVE-2025-26042

MEDIUM

Uptime Kuma >= 1.23.0 - Regular Expression Denial of Service via Notification String

Title source: llm
STIX 2.1

Description

Uptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. If a string is provided it triggers catastrophic backtracking in the regular expression, leading to a ReDoS attack.

References (3)

Core 3

Scores

CVSS v3 6.0
EPSS 0.0034
EPSS Percentile 26.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-1333
Status published
Products (1)
npm/uptime-kuma 1.15.0npm
Published Mar 17, 2025
Tracked Since Feb 18, 2026