CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2020-5243
High (7.5) in uap-core project uap-core. EPSS 2.3% chance of exploitation in the next 30 days. Fixed in uap-core 0.7.3.
uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This has been patched in uap-core 0.7.3.
Severity
- EPSS
- 2.3% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-1333, CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- uap-core_project:uap-core
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cmcx-xhr8-3w9p | npm | uap-core | <0.7.3 | 0.7.3 |
| GHSA-cmcx-xhr8-3w9p | RubyGems | user_agent_parser | <2.6.0 | 2.6.0 |
References
- https://github.com/ua-parser/uap-core/commit/0afd61ed85396a3b5316f18bfd1edfaadf8e88e1
- https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p
- https://github.com/ua-parser/uap-core/commit/0afd61ed85396a3b5316f18bfd1edfaadf8e88e1
- https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p