CVE-2025-24026: iTop Inefficient Regular Expression Complexity vulnerability
iTop is an web based IT Service Management tool. Versions prior to 3.2.1 are vulnerable to regular expression denial of service (ReDoS) that may, under some circumstances, affect iTop server. Version 3.2.1 doesn't use the affected variable in the regular expression. As a workaround, if iTop approoturl is defined in the configuration file, then there is no possible way to exploit this ReDoS.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24026?
CVE-2025-24026 is classified as a moderate severity vulnerability due to the potential denial of service risk posed by regular expression processing.
How do I fix CVE-2025-24026?
To fix CVE-2025-24026, upgrade iTop to version 3.2.1 or later, which mitigates the vulnerability.
What is the impact of CVE-2025-24026 on my iTop installation?
The impact of CVE-2025-24026 can lead to denial of service, causing the iTop server to become unresponsive under specific circumstances.
Which versions of iTop are affected by CVE-2025-24026?
CVE-2025-24026 affects all versions of iTop prior to 3.2.1.
Is there a workaround for CVE-2025-24026?
Aside from upgrading to version 3.2.1, there are no documented workarounds for CVE-2025-24026.