SB2026033162 - IBM Maximo Application Suite - Manage Component update for ajv

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026033162

SB2026033162 - IBM Maximo Application Suite - Manage Component update for ajv

Published: March 31, 2026

Security Bulletin ID SB2026033162
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Inefficient regular expression complexity (CVE-ID: CVE-2025-69873)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to the pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation, when the $data option is enabled. A local user can can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.


Remediation

Install update from vendor's website.

References