Skip to content
fr Sign in
2.9 Low

CVE-2025-69873 ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the…

Description

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.

Affected products and versions

Product Affected versions Fixed in
n/a Versions not published
Red Hat Ansible Automation Platform 2.5 for RHEL 8 Versions not published
Red Hat Ansible Automation Platform 2.5 for RHEL 9 Versions not published
Red Hat Ansible Automation Platform 2.6 for RHEL 9 Versions not published
Network Observability (NETOBSERV) 1.11.2 1778508956 earliest → < 1778508956 1778508956
Red Hat Ansible Automation Platform 2.6 1774243862 earliest → < 1774243862 1774243862
Red Hat Developer Hub 1.8 1776784286 earliest → < 1776784286 1776784286
Red Hat Developer Hub 1.9 1775140647 earliest → < 1775140647 1775140647
Red Hat OpenShift AI 2.16 1774282136 earliest → < 1774282136 1774282136
Show the 71 other branches
Product Affected versions Fixed in
Red Hat OpenShift AI 3.3 1778666987 earliest → < 1778666987 1778666987
Red Hat OpenShift Container Platform 4.14 1778036641 earliest → < 1778036641 1778036641
Red Hat OpenShift Container Platform 4.15 1777994844 earliest → < 1777994844 1777994844
Red Hat OpenShift Container Platform 4.16 1774452649 earliest → < 1774452649 1774452649
Red Hat OpenShift Container Platform 4.17 1774474908 earliest → < 1774474908 1774474908
Red Hat OpenShift Container Platform 4.19 1776675872 earliest → < 1776675872 1776675872
Red Hat OpenShift Dev Spaces 3.27 1774476526 earliest → < 1774476526 1774476526
Red Hat Quay 3.14 1775512163 earliest → < 1775512163 1775512163
Red Hat Quay 3.15 1775169219 earliest → < 1775169219 1775169219
Red Hat Quay 3.16 1775169226 earliest → < 1775169226 1775169226
Red Hat Quay 3.16 1775069491 earliest → < 1775069491 1775069491
Red Hat Quay 3.9 1773936323 earliest → < 1773936323 1773936323
Red Hat Satellite 6.18 1781181673 earliest → < 1781181673 1781181673
Confidential Compute Attestation Versions not published
Logging Subsystem for Red Hat OpenShift Versions not published
Node HealthCheck Operator Versions not published
OpenShift Pipelines Versions not published
Red Hat 3scale API Management Platform 2 Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat build of Apicurio Registry 2 Versions not published
Red Hat Connectivity Link 1 Versions not published
Red Hat Data Grid 8 Versions not published
Red Hat Edge Manager 1 Versions not published
Red Hat Enterprise Linux AI (RHEL AI) 3 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat Openshift Data Foundation 4 Versions not published
Red Hat OpenShift Dev Spaces Versions not published
Red Hat OpenShift GitOps Versions not published
Red Hat Single Sign-On 7 Versions not published
streams for Apache Kafka 3 Versions not published
Red Hat Ansible Automation Platform 2.6 for RHEL 10 Versions not published
Cryostat 4 Versions not published
Gatekeeper 3 Versions not published
Multicluster Engine for Kubernetes Versions not published
Network Observability Operator Versions not published
OpenShift Service Mesh 2 Versions not published
OpenShift Service Mesh 3 Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published
Red Hat Advanced Cluster Security 4 Versions not published
Red Hat AMQ Broker 7 Versions not published
Red Hat build of Apache Camel - HawtIO 4 Versions not published
Red Hat build of OptaPlanner 8 Versions not published
Red Hat Directory Server 11 Versions not published
Red Hat Directory Server 12 Versions not published
Red Hat Directory Server 13 Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat Process Automation 7 Versions not published
Red Hat Satellite 6 Versions not published
streams for Apache Kafka 2 Versions not published
ajv 7.0 7.0.0 → < 8.17.2 8.17.2
ajv 6.14 earliest → < 6.14.0 6.14.0
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server Versions not published
Red Hat Edge Manager 1.0 1783502438 earliest → < 1783502438 1783502438
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Versions not published
Red Hat Edge Manager 1.1 1784127736 earliest → < 1784127736 1784127736
Red Hat Openshift Data Foundation 4.20 1783669219 earliest → < 1783669219 1783669219
Red Hat Openshift Data Foundation 4.2 1783669219 earliest → < 1783669219 1783669219
Red Hat Openshift Data Foundation 4.18 1783677533 earliest → < 1783677533 1783677533
Red Hat Openshift Data Foundation 4.19 1783685375 earliest → < 1783685375 1783685375
Network Observability (NETOBSERV) 1.11.1 1778508956 earliest → < 1778508956 1778508956
Red Hat build of Apache Camel for Spring Boot 4 Versions not published
Red Hat build of Apicurio Registry 3 Versions not published
Red Hat Build of Keycloak Versions not published
Network Observability (NETOBSERV) 1.11.0 1778508956 earliest → < 1778508956 1778508956

References

Timeline

  1. Published
  2. Last modified

Other CVEs of n/a

The 144658 CVEs of n/a →
CVE-2026-106713 An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the… Not rated CVE-2026-106715 NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin… Not rated CVE-2026-106714 Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it… Not rated CVE-2026-106716 ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep… Not rated
Track this CVE