The ajv library used in Red Hat Satellite's Lightspeed component has a ReDoS vulnerability (CVE-2025-69873) when the $data option is enabled. This option allows dynamic regular expressions, but the pattern keyword's value is passed directly to JavaScript's RegExp() constructor without sufficient validation. An attacker able to supply a malicious regular expression pattern can cause excessive backtracking, leading to high CPU usage and denial of service. Exploitation requires the $data feature enabled and attacker input controlling the pattern. A 31-character crafted payload can cause about 44 seconds of execution delay, doubling with each additional character. Red Hat rates this as important severity but assigns a low CVSS score (2.9) for their products. The advisory recommends disabling $data if not needed or validating inputs strictly. No official fix or patch is currently provided in the advisory. The vulnerability affects ajv versions >=4.19.0 <4.19.29 and =6.18 as used in Red Hat Satellite 6.18 and related container images.

Exploitation of this vulnerability can cause a denial of service by making the application unresponsive due to CPU resource exhaustion triggered by crafted regular expressions. There is no impact on confidentiality or integrity. The attack complexity is high because it requires the $data option enabled and attacker-controlled input. No known exploits in the wild have been reported. The impact is limited to availability degradation.

Red Hat's advisory does not list an official patch or fix at this time. To mitigate this issue, disable the $data feature in ajv if it is not required by your application. If $data must be used, implement strict validation on input fields referenced by the pattern keyword to ensure only safe and expected characters are allowed. Monitor Red Hat advisories for updates or patches. Since this is not a cloud service, remediation depends on applying configuration changes or updates when available.