EUVD-2025-17566Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to RocketChat IRC
-
DeliverySend crafted IRC message with malicious input
-
ExploitTrigger ReDoS in parseMessage
-
ExecutionCause CPU exhaustion
-
ImpactDenial of service for other users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must be authenticated to the RocketChat IRC server (PR:L). The attack is remote over the network (AV:N) with low complexity (AC:L). No special configuration is required; the IRC server module must be enabled. The attack does not require user interaction (UI:N). |
| Impact | CVSS 4.0 base score is 2.1 (Low) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L, indicating low impact. EPSS score is 0.22% (44th percentile), suggesting low exploitation probability. No KEV listing. Public exploit code exists but no active exploitation confirmed. SSVC decision: exploitation status 'Public PoC', automatable 'Yes', technical impact 'Partial' (DoS only). Overall risk is low; the vulnerability is a low-priority DoS requiring authentication. |
| Exploit ScenarioDerived | An authenticated attacker sends a specially crafted IRC message with a long string of spaces and a null byte to the RocketChat server. The parseMessage function's regex causes excessive CPU consumption, leading to denial of service for other users. Public exploit code is available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
Inefficient regular expression in RocketChat's IRC parseMessage function allows remote authenticated users to cause a denial of service via crafted input. A publicly available exploit exists, but no active exploitation has been reported. EPSS score is low (0.22%), indicating low exploitation likelihood.
Earlier versions of this analysis (1)
RemediationAI
Upgrade to RocketChat version 7.6.2 or later, which includes the fix from GitHub pull request #35711. The fix modifies the regex to prevent catastrophic backtracking. No workarounds are documented; as a compensating control, restrict access to the IRC server functionality to trusted users only, though this may not be feasible in all deployments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in the parseMessage function of RocketChat's IRC server module (RFC2813). The affected regex /^:|\s+:/ exhibits catastrophic backtracking when processing specially crafted input. CPE data confirms all RocketChat versions up to 7.6.1 are affected. The CWE-400 class covers resource exhaustion via uncontrolled resource consumption.
Know when Rocket Chat gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
AV:N, AC:L, PR:L (authenticated), UI:N, A:L (DoS only).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability, which was classified as problematic, has been found in RocketChat up to 7.6.1. This issue affects the function parseMessage of the file /apps/meteor/app/irc/server/servers/RFC2813/parseMessage.js. The manipulation of the argument line leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
Organizations using RocketChat should be aware of moderate risk from CVE-2025-5892, a resource exhaustion vulnerability rated CVSS 4.3. Service availability could be impacted. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement rate limiting and resource quotas.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Rocket Chat
View allA sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti
A improper authentication vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 that allowed two factor authentic
A SQL injection vulnerability exists in Rocket.Chat <v3.18.6, <v4.4.4 and <v4.7.3 which can allow an attacker to retriev
A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1. Rated high sev
Rocket.Chat versions prior to 6.12.0 expose the OAuth applications API endpoint to any authenticated user, allowing disc
An information disclosure vulnerability exists in the Rocket.Chat server fixed v3.13, v3.12.2 & v3.11.3 that allowed ema
An improper authentication vulnerability exists in Rocket.Chat Mobile App <4.14.1.22788 that allowed an attacker with ph
A cleartext transmission of sensitive information exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 relating to Oauth token
An information disclosure vulnerability exists in Rocket.Chat <v5 due to the getUserMentionsByChannel meteor server meth
Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript. Rated medium severity
A blind self XSS vulnerability exists in RocketChat LiveChat <v1.9 that could allow an attacker to trick a victim pastin
Exploit-DB