VDB
RHSA-2026%3A5910
RHSA-2026%3A5910
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in ajv. When the $data option is enabled, the value of the pattern keyword is passed directly to the JavaScript RegExp() constructor without sufficient validation. An attacker able to supply a malicious regular expression pattern can trigger a ReDoS (Regular Expression Denial of Service), causing the application to become unresponsive and resulting in a denial of service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-cluster-bootstrap-rhel9@sha256:9c17ddc93faeb7311e9456b8131eba4ef7e0404cb2ca0d4b340c736fa1889594_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-cluster-bootstrap-rhel9@sha256:9c17ddc93faeb7311e9456b8131eba4ef7e0404cb2ca0d4b340c736fa1889594_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-machine-api-rhel9-operator@sha256:0441b80a944ecb61e874430b224503609565638f79019e63da36668359b98def_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-machine-api-rhel9-operator@sha256:0441b80a944ecb61e874430b224503609565638f79019e63da36668359b98def_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-openshift-controller-manager-rhel9@sha256:2c87dce53c0920d3fbcac56c5bf8f7c70edf54f171f2db470d2a705f108fa8cb_s390x as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-openshift-controller-manager-rhel9@sha256:2c87dce53c0920d3fbcac56c5bf8f7c70edf54f171f2db470d2a705f108fa8cb_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-ironic-machine-os-downloader-rhel9@sha256:33b50ba656686e49101f62377587175d2a26c9b2407a31f821b28dc5673d3815_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | *, registry.redhat.io/openshift4/ose-ironic-machine-os-downloader-rhel9@sha256:33b50ba656686e49101f62377587175d2a26c9b2407a31f821b28dc5673d3815_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-cli-rhel9@sha256:9d835a6fe4375adf7474f50ade01d2c05e9551f94e200691e0bf6e635fccb99c_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-cli-rhel9@sha256:9d835a6fe4375adf7474f50ade01d2c05e9551f94e200691e0bf6e635fccb99c_arm64, registry.redhat.io/openshift4/ose-cli-rhel9@sha256:9d835a6fe4375adf7474f50ade01d2c05e9551f94e200691e0bf6e635fccb99c_arm64, registry.redhat.io/openshift4/ose-cli-rhel9@sha256:9d835a6fe4375adf7474f50ade01d2c05e9551f94e200691e0bf6e635fccb99c_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-ovn-kubernetes-rhel9@sha256:75b2b01ac003a058579cd460a0078ebd60203b98a0fccfaf82c965717d877e53_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-ovn-kubernetes-rhel9@sha256:75b2b01ac003a058579cd460a0078ebd60203b98a0fccfaf82c965717d877e53_arm64, registry.redhat.io/openshift4/ose-ovn-kubernetes-rhel9@sha256:75b2b01ac003a058579cd460a0078ebd60203b98a0fccfaf82c965717d877e53_arm64, registry.redhat.io/openshift4/ose-ovn-kubernetes-rhel9@sha256:75b2b01ac003a058579cd460a0078ebd60203b98a0fccfaf82c965717d877e53_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-prometheus-config-reloader-rhel9@sha256:82c1d0a2a92f70ac434d223c568178daa4ddb67e0ee58944faf381dcb977e7ed_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-prometheus-config-reloader-rhel9@sha256:82c1d0a2a92f70ac434d223c568178daa4ddb67e0ee58944faf381dcb977e7ed_arm64, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9@sha256:5d7f2f7f44e95c44b52061911b935feda57913b8d7c476827e92a201cccadf17_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9@sha256:5d7f2f7f44e95c44b52061911b935feda57913b8d7c476827e92a201cccadf17_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-storage-rhel9-operator@sha256:1f7e578b252a8eb6be49252904042c549676d02e6a0518963af26b0d603e3a04_s390x as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-cluster-storage-rhel9-operator@sha256:1f7e578b252a8eb6be49252904042c549676d02e6a0518963af26b0d603e3a04_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel9@sha256:66968a07c5398976200a7dcdaf29ec321f9180d1b90af0dcdcfc6eefe1342577_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel9@sha256:66968a07c5398976200a7dcdaf29ec321f9180d1b90af0dcdcfc6eefe1342577_arm64, registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel9@sha256:66968a07c5398976200a7dcdaf29ec321f9180d1b90af0dcdcfc6eefe1342577_arm64, registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel9@sha256:66968a07c5398976200a7dcdaf29ec321f9180d1b90af0dcdcfc6eefe1342577_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-kube-storage-version-migrator-rhel9@sha256:be0b31aee69409243b2026a3bfe8bcf52ba65dca9024f173fb66cf81082736b8_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-kube-storage-version-migrator-rhel9@sha256:be0b31aee69409243b2026a3bfe8bcf52ba65dca9024f173fb66cf81082736b8_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-openshift-apiserver-rhel9-operator@sha256:d27a0cb5ff1cad05ee9e7e1808810069db8fa7f73b1d7154253cfc20672409ee_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-cluster-openshift-apiserver-rhel9-operator@sha256:d27a0cb5ff1cad05ee9e7e1808810069db8fa7f73b1d7154253cfc20672409ee_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-network-rhel9-operator@sha256:7c5c21bffbf45377b1864ff4820310c926addeb20c2dbca1beb1e861a666628a_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-multus-cni-rhel9@sha256:9cd8ba1a9c9e497bedc72709a3b383ba611f9500beba0be89584a0802287c48d_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-multus-cni-rhel9@sha256:9cd8ba1a9c9e497bedc72709a3b383ba611f9500beba0be89584a0802287c48d_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-keepalived-ipfailover-rhel9@sha256:288b1b934ddfed4305a99d37ac099e1562c629f505488878230b4c67924bed2d_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-olm-catalogd-rhel9@sha256:675c674c399398b0b16974f6fd6052acc56b6ad11776f559b25657495289658b_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-olm-catalogd-rhel9@sha256:675c674c399398b0b16974f6fd6052acc56b6ad11776f559b25657495289658b_amd64, registry.redhat.io/openshift4/ose-olm-catalogd-rhel9@sha256:675c674c399398b0b16974f6fd6052acc56b6ad11776f559b25657495289658b_amd64, registry.redhat.io/openshift4/ose-olm-catalogd-rhel9@sha256:675c674c399398b0b16974f6fd6052acc56b6ad11776f559b25657495289658b_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-networking-console-plugin-rhel9@sha256:a9834b7c965926992a9290bdd291f63931b5ff6a3c64fc7131dd55861c941e91_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-networking-console-plugin-rhel9@sha256:a9834b7c965926992a9290bdd291f63931b5ff6a3c64fc7131dd55861c941e91_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-samples-rhel9-operator@sha256:4827e2fba1a10e3a2abfc904cd298121d9cccfe4afeaae93b26559d8a76c7dfb_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-cluster-samples-rhel9-operator@sha256:4827e2fba1a10e3a2abfc904cd298121d9cccfe4afeaae93b26559d8a76c7dfb_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-csi-driver-shared-resource-rhel9-operator@sha256:a80c47da0a776c92ef3b38f7997876996e6b46b431e86d82303236ba2a1fb5ed_s390x as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-csi-snapshot-controller-rhel9-operator@sha256:d619b6d2f2a7407096eccad753fdce3d1200c3a0dfcd9df3f1aeffd5765af0c9_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | registry.redhat.io/openshift4/ose-cluster-csi-snapshot-controller-rhel9-operator@sha256:d619b6d2f2a7407096eccad753fdce3d1200c3a0dfcd9df3f1aeffd5765af0c9_arm64 |
…and 1300 more
Exploit Intelligence
- cve_2025_69873_redos_attack.spec.ts (github-poc)
- audit_report.json (github-poc)
- mockData.ts (github-poc)
Timeline
- Apr 2, 2026 CVE Published
- Apr 29, 2026 Distribution Patch
- Apr 29, 2026 Distribution Patch
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- May 13, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:5910 advisory
- https://access.redhat.com/security/cve/CVE-2025-69873 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_5910.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2439070 issue
- https://www.cve.org/CVERecord?id=CVE-2025-69873 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-69873 advisory
- https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md advisory