Skip to content
Fencer Intel
high 7.5

CVE-2025-69873 json

ajv has ReDoS when using `$data` option

published 8mo ago modified last mo. also GHSA-2g4f-4pwh-qvx6 , EUVD-2025-207389

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits
0
none known

Summary

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.

Patch / fix

  • npm ajv 6.14.0, 8.18.0
  • ajv.js ajv 6.14.0, 8.17.2
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:2.5.20260422-2.el8ap
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:2.5.20260422-2.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:2.6.7-1.el9ap
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 0:7.3.18-3.GA_redhat_00001.1.el7eap
  • Red Hat Network Observability (NETOBSERV) 1.11.0 1778508956
  • Red Hat Red Hat Ansible Automation Platform 2.6 1774243862
  • Red Hat Red Hat Developer Hub 1.8 1776784286
  • Red Hat Red Hat Developer Hub 1.9 1775140647
  • Red Hat Red Hat Edge Manager 1.0 1783502438, 1783502765
  • Red Hat Red Hat Edge Manager 1.1 1784126822, 1784127736, 1784194574, 1784194938
  • Red Hat Red Hat OpenShift AI 2.16 1774282136
  • Red Hat Red Hat OpenShift AI 3.3 1778473763, 1778666987, 1779189627
  • Red Hat Red Hat OpenShift Container Platform 4.14 1778036641
  • Red Hat Red Hat OpenShift Container Platform 4.15 1777994844
  • Red Hat Red Hat OpenShift Container Platform 4.16 1774452649
  • Red Hat Red Hat OpenShift Container Platform 4.17 1774474908
  • Red Hat Red Hat OpenShift Container Platform 4.19 1776675872
  • Red Hat Red Hat Openshift Data Foundation 4.18 1783676191, 1783676585, 1783676649, 1783676675, 1783676820, 1783676883, 1783676894, 1783676977, 1783677297, 1783677345, 1783677533, 1783929816, 1784093503, 1784093953, 1784094299, 1784094353, 1784094725, 1784094943, 1784095175
  • Red Hat Red Hat Openshift Data Foundation 4.19 1783684068, 1783684360, 1783684603, 1783684667, 1783684668, 1783684707, 1783684779, 1783684831, 1783684839, 1783685128, 1783685129, 1783685375, 1784054582, 1784054606, 1784054873, 1784055295, 1784055533, 1784055558, 1784055589, 1784056134
  • Red Hat Red Hat Openshift Data Foundation 4.20 1783666755, 1783667125, 1783667517, 1783667577, 1783667611, 1783667641, 1783667790, 1783667859, 1783667869, 1783667875, 1783667877, 1783668266, 1784054598, 1784055020, 1784055244, 1784055382, 1784055387, 1784055576, 1784055586, 1784055726
  • Red Hat Red Hat OpenShift Dev Spaces 3.27 1774448966, 1774476526
  • Red Hat Red Hat Quay 3.14 1775512163
  • Red Hat Red Hat Quay 3.15 1775169219
  • Red Hat Red Hat Quay 3.16 1775069491, 1775169226
  • Red Hat Red Hat Quay 3.9 1773936323
  • Red Hat Red Hat Satellite 6.18 1781181673, 1781247025
  • node-ajv Debian 14 8.18.0~ds+~cs6.1.1-1

debian advisories DEBIAN-CVE-2025-69873

  • receptor ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.4-2.el8ap
  • receptor ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.4-2.el9ap
  • python3.12-pyjwt ansible automation platform 2.5 2.12.1-1.el8ap
  • python3.12-pyjwt ansible automation platform 2.5 2.12.1-1.el9ap
  • python3.12-pyasn1 ansible automation platform 2.5 0.6.3-1.el8ap
  • python3.12-pyasn1 ansible automation platform 2.5 0.6.3-1.el9ap
  • python3.12-jwcrypto ansible automation platform 2.5 1.5.7-1.el8ap
  • python3.12-jwcrypto ansible automation platform 2.5 1.5.7-1.el9ap

red hat advisories RHSA-2026:33371RHSA-2026:13512RHSA-2026:6277

Is CVE-2025-69873 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-69873 updated cvss 7.5

ajv: ReDoS via $data reference

  • Red Hat Confidential Compute Attestation openshift-sandboxed-containers/osc-pccs Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8, openshift-logging/elasticsearch6-rhel9, openshift-logging/logging-curator5-rhel9, openshift-logging/elasticsearch-proxy-rhel9, openshift-logging/logging-view-plugin-rhel9, openshift-logging/elasticsearch-rhel9-operator, +1 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-hub-api-rhel8, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-hub-db-migration-rhel8 Red Hat 3scale API Management Platform 2 3scale-amp20/system, 3scale-amp21/system, 3scale-amp22/system, 3scale-amp24/system, 3scale-amp25/system, 3scale-amp26/system, +3 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2 ansible-on-clouds/aoc-azure-aap-installer-rhel9 Red Hat build of Apache Camel - HawtIO 4 ajv 8.12.0
    affected: workaround, no fix available
  • Red Hat build of Apicurio Registry 2 io.apicurio-apicurio-registry Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Data Grid 8 org.infinispan-infinispan-console
    affected: workaround, no fix available
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/disk-image-cuda-rhel9 Red Hat Fuse 7 io.hawt-project, io.apicurio-apicurito, io.hawt-hawtio-online, io.syndesis-syndesis-parent Red Hat JBoss Enterprise Application Platform Expansion Pack io.hawt-project, org.keycloak-keycloak-parent, io.smallrye-smallrye-open-api-parent
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Dev Spaces devspaces/machineexec-rhel9
    affected: workaround, no fix available
show 23 more
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 Red Hat Single Sign-On 7 org.keycloak-keycloak-parent Red Hat streams for Apache Kafka 3 com.github.streamshub-console
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Network Observability (NETOBSERV) 1.11.0 network-observability 1778508956
    fixed: vendor fix RHSA-2026:16874
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-gateway-server 2.5.20260422-2.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-gateway-server 2.5.20260422-2.el9ap
    fixed: vendor fix RHSA-2026:13512
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26 1774243862
    fixed: vendor fix RHSA-2026:6309
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-platform-ui 2.6.7-1.el9ap
    fixed: vendor fix RHSA-2026:6277
  • Red Hat Ceph Storage 9.2 rhceph/rhceph-9-rhel10 1790843527
    fixed: vendor fix RHSA-2026:86618
  • Red Hat Developer Hub 1.8 rhdh 1776784286
    fixed: vendor fix RHSA-2026:9742
  • Red Hat Developer Hub 1.9 rhdh 1775140647
    fixed: vendor fix RHSA-2026:6802
  • Red Hat Edge Manager 1.0 rhem/flightctl-ui-rhel9 1783502438, rhem/flightctl-ui-ocp-rhel9 1783502765
    fixed: vendor fix RHSA-2026:36651
  • Red Hat Edge Manager 1.1 rhem/flightctl-ui-rhel9 1784127736, rhem/flightctl-ui-rhel10 1784194574, rhem/flightctl-ui-ocp-rhel9 1784126822, rhem/flightctl-ui-ocp-rhel10 1784194938
    fixed: vendor fix RHSA-2026:40945
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-wildfly 7.3.18-3.GA_redhat_00001.1.el7eap, eap7-wildfly-modules 7.3.18-3.GA_redhat_00001.1.el7eap, eap7-wildfly-javadocs 7.3.18-3.GA_redhat_00001.1.el7eap, eap7-wildfly-java-jdk8 7.3.18-3.GA_redhat_00001.1.el7eap, eap7-wildfly-java-jdk11 7.3.18-3.GA_redhat_00001.1.el7eap
    fixed: vendor fix RHSA-2026:33371
  • Red Hat OpenShift AI 2.16 rhoai 1774282136
    fixed: vendor fix RHSA-2026:5807
  • Red Hat OpenShift AI 3.3 rhoai 1778473763, rhoai 1778666987, rhoai 1779189627
    fixed: vendor fix RHSA-2026:19712
  • Red Hat OpenShift Container Platform 4.14 openshift4 1778036641
    fixed: vendor fix RHSA-2026:15091
  • Red Hat OpenShift Container Platform 4.15 openshift4 1777994844
    fixed: vendor fix RHSA-2026:14774
  • Red Hat OpenShift Container Platform 4.16 openshift4 1774452649
    fixed: vendor fix RHSA-2026:5910
  • Red Hat OpenShift Container Platform 4.17 openshift4 1774474908
    fixed: vendor fix RHSA-2026:5907
  • Red Hat OpenShift Container Platform 4.19 openshift4 1776675872
    fixed: vendor fix RHSA-2026:10093
  • Red Hat Openshift Data Foundation 4.16 odf4/cephcsi-rhel9 1791969746, odf4/odf-cli-rhel9 1791966130, odf4/mcg-core-rhel9 1791967127, odf4/odf-console-rhel9 1791966989, odf4/mcg-rhel9-operator 1791970996, odf4/ocs-rhel9-operator 1791968560, +12 more
    fixed: vendor fix RHSA-2026:83619
  • Red Hat Openshift Data Foundation 4.17 odf4/cephcsi-rhel9 1791966003, odf4/odf-cli-rhel9 1791888742, odf4/mcg-core-rhel9 1791889616, odf4/odf-console-rhel9 1791887928, odf4/mcg-rhel9-operator 1791889753, odf4/ocs-rhel9-operator 1791960285, +13 more
    fixed: vendor fix RHSA-2026:83622
  • Red Hat Openshift Data Foundation 4.18 odf4/cephcsi-rhel9 1783676191, odf4/odf-cli-rhel9 1784094299, odf4/mcg-core-rhel9 1784094353, odf4/odf-console-rhel9 1784094725, odf4/mcg-rhel9-operator 1784093953, odf4/ocs-rhel9-operator 1783676675, +13 more
    fixed: vendor fix RHSA-2026:41941
  • Red Hat Openshift Data Foundation 4.19 odf4/cephcsi-rhel9 1783684360, odf4/odf-cli-rhel9 1784054873, odf4/mcg-core-rhel9 1784054582, odf4/odf-console-rhel9 1784055589, odf4/mcg-rhel9-operator 1784054606, odf4/ocs-rhel9-operator 1783684667, +14 more
    fixed: vendor fix RHSA-2026:41944
  • Red Hat Openshift Data Foundation 4.20 odf4/cephcsi-rhel9 1783667125, odf4/odf-cli-rhel9 1784055020, odf4/mcg-core-rhel9 1784054598, odf4/odf-console-rhel9 1784055586, odf4/mcg-rhel9-operator 1784055387, odf4/ocs-rhel9-operator 1783667611, +16 more
    fixed: vendor fix RHSA-2026:40984

6 more fixed, 60 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
8mo ago

Exploit prediction

0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm ajv
>=7.0.0-alpha.0, <8.18.0
<6.14.0
8.18.0
6.14.0

Affected products

  • ajv.js ajv
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
  • Red Hat Network Observability (NETOBSERV) 1.11.0
  • Red Hat Red Hat Ansible Automation Platform 2.6
  • Red Hat Red Hat Developer Hub 1.8
  • Red Hat Red Hat Developer Hub 1.9
  • Red Hat Red Hat Edge Manager 1.0
  • Red Hat Red Hat Edge Manager 1.1
  • Red Hat Red Hat OpenShift AI 2.16
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat Openshift Data Foundation 4.18
  • Red Hat Red Hat Openshift Data Foundation 4.19
  • Red Hat Red Hat Openshift Data Foundation 4.20
  • Red Hat Red Hat OpenShift Dev Spaces 3.27
  • Red Hat Red Hat Quay 3.14
  • Red Hat Red Hat Quay 3.15
  • Red Hat Red Hat Quay 3.16
  • Red Hat Red Hat Quay 3.9
  • Red Hat Red Hat Satellite 6.18
  • Red Hat Confidential Compute Attestation
  • Red Hat Cryostat 4
  • Red Hat Gatekeeper 3
  • Red Hat Logging Subsystem for Red Hat OpenShift
  • Red Hat Multicluster Engine for Kubernetes
  • Red Hat Network Observability Operator
  • Red Hat Node HealthCheck Operator
  • Red Hat OpenShift Pipelines
  • Red Hat OpenShift Service Mesh 2
  • Red Hat OpenShift Service Mesh 3
  • Red Hat Red Hat 3scale API Management Platform 2
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Red Hat Advanced Cluster Security 4
  • Red Hat Red Hat AMQ Broker 7
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat Red Hat build of Apache Camel - HawtIO 4
  • Red Hat Red Hat build of Apicurio Registry 2
  • Red Hat Red Hat build of Apicurio Registry 3
  • Red Hat Red Hat Build of Keycloak
  • Red Hat Red Hat build of OptaPlanner 8
  • Red Hat Red Hat Connectivity Link 1
  • Red Hat Red Hat Data Grid 8

Classification

Weakness
  • CWE-1333 Inefficient Regular Expression Complexity
  • CWE-400 Uncontrolled Resource Consumption
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.