[GHSA-3rw8-4xrq-3f7p] Uptime Kuma ReDoS vulnerability #5969
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR updates a GitHub security advisory for Uptime Kuma's ReDoS vulnerability (GHSA-3rw8-4xrq-3f7p) with corrected information and additional references.
- Updates the CVSS scoring by removing CVSS v3 and keeping only CVSS v4
- Changes affected version information to specify fix version (2.0.0-beta.2) instead of last affected version
- Adds reference to the upstream security advisory
advisories/github-reviewed/2025/03/GHSA-3rw8-4xrq-3f7p/GHSA-3rw8-4xrq-3f7p.json
Show resolved
Hide resolved
github-actions
bot
changed the base branch from
main
to
marcschaeferger/advisory-improvement-5969
|
Hi @marcschaeferger, as you pointed out in #5970, GHSA-3rw8-4xrq-3f7p is a duplicate of GHSA-hx7h-9vf7-5xhg. I'm going to withdraw GHSA-3rw8-4xrq-3f7p and transfer CVE-2025-26042 to GHSA-hx7h-9vf7-5xhg. You will receive credit in GHSA-3rw8-4xrq-3f7p for informing me of the duplicate advisory. |
advisory-database
bot
merged commit ecb710d
into
marcschaeferger/advisory-improvement-5969
|
Hi @marcschaeferger! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future! |
Updates
Comments
CVE has been fixed in 2.0.0-beta.2 and above. See GHSA-hx7h-9vf7-5xhg
Currently the CVE ID is also missing in the mentioned Advisorie.