Executive brief
Uptime Kuma is a popular open-source status page and monitoring application. Administrators can configure notifications through pushdeer and whapi services. A ReDoS (Regular Expression Denial of Service) vulnerability in the URL validation logic allows an attacker to craft a malicious URL that causes the application to hang or become unresponsive, disrupting monitoring and alerting capabilities and degrading service availability.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) caused by catastrophic backtracking in the regex pattern `/\/*$/` used to strip trailing slashes from URLs in the pushdeer.js and whapi.js notification providers. When an attacker provides a URL containing a large number of repeated forward slashes followed by a non-slash character (e.g., "https://e" + "/" repeated 100,000 times + "@"), the regex engine enters excessive backtracking, consuming significant CPU resources and causing the web service to freeze for over 2 seconds. Attack requires administrator privileges to configure notifications through the web interface. The vulnerability affects versions 1.15.0 through 1.23.16, and 2.0.0-beta.0 and 2.0.0-beta.1, with a patch available in version 2.0.0-beta.2.
Affected products
- Uptime Kuma Uptime Kuma >=1.15.0, <=1.23.16, 2.0.0-beta.0, 2.0.0-beta.1
Timeline
- 2025-03-31: disclosed
- 2025-03-29: patched: Patch available in version 2.0.0-beta.2