GHSA-pcqq-5962-hvcw
Denial of Service in uap-core when processing crafted User-Agent strings
Impact
Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.
Patches
Please update uap-ruby to >= v2.6.0
For more information
https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p
Reported in uap-core by Ben Caller @bcaller
What each source reports
GitHub AdvisoriesNo score
Denial of Service in uap-core when processing crafted User-Agent strings
Impact
Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.
Patches
Please update uap-ruby to >= v2.6.0
For more information
https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p
Reported in uap-core by Ben Caller @bcaller
- Record
GHSA-pcqq-5962-hvcw- Updated
- 2026-11-02
OSVNo score
Denial of Service in uap-core when processing crafted User-Agent strings
Impact
Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.
Patches
Please update uap-ruby to >= v2.6.0
For more information
https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p
Reported in uap-core by Ben Caller @bcaller
- Record
GHSA-pcqq-5962-hvcw- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
user_agent_parserRubyGems | before 2.6.0 | 2.6.0 |
user_agent_parserRubyGems | before 2.6.0, plus listed versions 0.1.00.1.10.1.21.0.01.0.1 Show 18 moreShow less1.0.22.0.02.1.02.1.12.1.22.1.32.1.42.1.52.2.02.3.02.3.12.3.22.4.02.4.12.5.02.5.12.5.22.5.3 | 2.6.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-pcqq-5962-hvcw is a vulnerability with no CVSS score yet in user_agent_parser, published March 10, 2020. No source lists public exploit code. Fixed in user_agent_parser 2.6.0.