GHSA-3rw8-4xrq-3f7p: Duplicate Advisory: Uptime Kuma ReDoS vulnerability

March 17, 2025 (updated August 7, 2025)

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-hx7h-9vf7-5xhg. This link is maintained to preserve external references.

Original Description

Uptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. If a string is provided it triggers catastrophic backtracking in the regular expression, leading to a ReDoS attack.

References

github.com/advisories/GHSA-3rw8-4xrq-3f7p
github.com/louislam/uptime-kuma
github.com/louislam/uptime-kuma/commit/7a9191761dbef6551c2a0aa6eed5f693ba48d688
github.com/louislam/uptime-kuma/issues/5574
github.com/louislam/uptime-kuma/pull/5573
nvd.nist.gov/vuln/detail/CVE-2025-26042

Code Behaviors & Features

Detect and mitigate GHSA-3rw8-4xrq-3f7p with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →