Vulnerability · Published Jun 9, 2025 · Assigned by VulDB

CVE-2025-5892RocketChat parseMessage.js parseMessage redos

Medium 4.3

In plain English

A medium-severity regular-expression denial of service in RocketChat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.7%top 48.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as problematic, has been found in RocketChat up to 7.6.1. This issue affects the function parseMessage of the file /apps/meteor/app/irc/server/servers/RFC2813/parseMessage.js. The manipulation of the argument line leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
n/a	RocketChat	7.6.07.6.1

Weakness: CWE-1333, CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:T/RC:R

References

VDB-311663 | RocketChat parseMessage.js parseMessage redos vdb-entry, technical-description
VDB-311663 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #585751 | @rocket.chat 7.6.1 Inefficient Regular Expression Complexity third-party-advisory
https://github.com/RocketChat/Rocket.Chat/pull/35711 issue-tracking
https://gist.github.com/mmmsssttt404/0fcda3b3e85edafc4eaa6816aa252deb exploit