CVE-2025-69873
Vulnerability Summary
Timeline
Description
ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.
CVSS Metrics
- v4.0•MEDIUM•Score: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
- v3.1•LOW•Score: 2.9CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Trends
Current EPSS score: 0.50%• Percentile: 42%
Techniques & Countermeasures
- CWE-1333•Inefficient Regular Expression Complexity
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
- CWE-400•Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
Affected Systems
- ajv.js•ajv
≥ 7.0.0, < 8.18.0 | < 6.14.0 | ≥ 7.0.0, < 8.17.2
- chainguard•arangodb-3.11
< 3.11.14.3-r0
- chainguard•arangodb-3.12
< 3.12.7.2-r1 | < 3.12.7.2-r2
- chainguard•argo-workflows-ui-3.6
< 3.6.19-r2
- chainguard•argo-workflows-ui-3.7
< 3.7.10-r3
- chainguard•argo-workflows-ui-4.0
< 4.0.1-r2
- chainguard•authentik-2025.12
all
- chainguard•authentik-2026.2
< 2026.2.5-r5
- chainguard•authentik-fips-2025.12
all
- chainguard•authentik-fips-2026.2
< 2026.2.6-r8
- chainguard•drupal-11.3
< 11.3.13-r3
- chainguard•eslint
< 10.0.2-r0
- chainguard•gemini-cli
< 0.49.0-r4
- chainguard•gitlab-rails-ce-18.1
all
- chainguard•gitlab-rails-ce-18.10
all
- chainguard•gitlab-rails-ce-18.11
all
- chainguard•gitlab-rails-ce-18.5
all
- chainguard•gitlab-rails-ce-18.6
all
- chainguard•gitlab-rails-ce-18.7
all
- chainguard•gitlab-rails-ce-18.8
all
- chainguard•gitlab-rails-ce-18.9
all
- chainguard•gitlab-rails-ce-19.0
all | < 19.0.3-r1
- chainguard•gitlab-rails-ce-19.1
all | < 19.1.7-r6
- chainguard•gitlab-rails-ce-19.2
all | < 19.2.5-r2
- chainguard•gitlab-rails-ce-19.3
< 19.3.1-r6
- chainguard•gitlab-rails-ce-fips-18.1
< 18.1.6-r15 | all
- chainguard•gitlab-rails-ce-fips-18.10
all
- chainguard•gitlab-rails-ce-fips-18.11
all
- chainguard•gitlab-rails-ce-fips-18.5
all
- chainguard•gitlab-rails-ce-fips-18.6
all
- chainguard•gitlab-rails-ce-fips-18.7
all
- chainguard•gitlab-rails-ce-fips-18.8
all
- chainguard•gitlab-rails-ce-fips-18.9
all
- chainguard•gitlab-rails-ce-fips-19.0
all
- chainguard•gitlab-rails-ce-fips-19.1
all | < 19.1.1-r1 | < 19.1.7-r7
- chainguard•gitlab-rails-ce-fips-19.2
all | < 19.2.5-r2
- chainguard•gitlab-rails-ce-fips-19.3
< 19.3.1-r3
- chainguard•jupyter-base-notebook
all
- chainguard•katib-earlystopping
< 0.19.0-r31
- chainguard•katib-suggestion-goptuna-compat
all
- chainguard•katib-suggestion-hyperband
< 0.19.0-r31
- chainguard•katib-suggestion-hyperopt
< 0.19.0-r31 | < 0.19.0-r40
- chainguard•katib-suggestion-nas-darts
< 0.19.0-r31
- chainguard•katib-suggestion-nas-enas
< 0.19.0-r31
- chainguard•katib-suggestion-optuna-enas
< 0.19.0-r31
- chainguard•katib-suggestion-pbt-enas
< 0.19.0-r31
- chainguard•katib-suggestion-skopt-enas
< 0.19.0-r31
- chainguard•katib-tfevent-metricscollector
< 0.19.0-r31
- chainguard•kibana-8.17
all
- chainguard•kibana-8.17-bitnami
all
Showing first 50 affected entries in server-rendered view.
References (46)
- https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md
- https://nvd.nist.gov/vuln/detail/CVE-2025-69873
- https://github.com/ajv-validator/ajv/pull/2586
- https://github.com/ajv-validator/ajv/commit/720a23fa453ffae8340e92c9b0fe886c54cfe0d5
- https://github.com/ajv-validator/ajv
- https://github.com/ajv-validator/ajv/releases/tag/v8.18.0
- https://github.com/ajv-validator/ajv/pull/2588
- https://github.com/ajv-validator/ajv/releases/tag/v6.14.0
- https://github.com/advisories/GHSA-2g4f-4pwh-qvx6
- https://github.com/github/advisory-database/pull/6991
- https://github.com/ajv-validator/ajv/pull/2590
- https://access.redhat.com/security/cve/CVE-2025-69873
- https://bugzilla.redhat.com/show_bug.cgi?id=2439070
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69873.json
- https://access.redhat.com/errata/RHSA-2026:13512
- https://access.redhat.com/errata/RHSA-2026:6277
- https://access.redhat.com/errata/RHSA-2026:16874
- https://access.redhat.com/errata/RHSA-2026:6309
- https://access.redhat.com/errata/RHSA-2026:9742
- https://access.redhat.com/errata/RHSA-2026:6802
- https://access.redhat.com/errata/RHSA-2026:5807
- https://access.redhat.com/errata/RHSA-2026:19712
- https://access.redhat.com/errata/RHSA-2026:15091
- https://access.redhat.com/errata/RHSA-2026:14774
- https://access.redhat.com/errata/RHSA-2026:5910
- https://access.redhat.com/errata/RHSA-2026:5907
- https://access.redhat.com/errata/RHSA-2026:10093
- https://access.redhat.com/errata/RHSA-2026:6192
- https://access.redhat.com/errata/RHSA-2026:7314
- https://access.redhat.com/errata/RHSA-2026:6568
- https://access.redhat.com/errata/RHSA-2026:6497
- https://access.redhat.com/errata/RHSA-2026:6567
- https://access.redhat.com/errata/RHSA-2026:5168
- https://access.redhat.com/errata/RHSA-2026:26214
- https://access.redhat.com/errata/RHSA-2026:26211
- https://access.redhat.com/errata/RHSA-2026:33371
- https://access.redhat.com/errata/RHSA-2026:36651
- https://access.redhat.com/errata/RHSA-2026:40945
- https://access.redhat.com/errata/RHSA-2026:40118
- https://access.redhat.com/errata/RHSA-2026:40984
- https://access.redhat.com/errata/RHSA-2026:41941
- https://access.redhat.com/errata/RHSA-2026:41944
- https://ubuntu.com/security/CVE-2025-69873
- https://www.cve.org/CVERecord?id=CVE-2025-69873
- https://security-tracker.debian.org/tracker/CVE-2025-69873
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69873.json