{"id":"CVE-2018-20164","aliases":["DEBIAN-CVE-2018-20164","EUVD-2019-0379","GHSA-fx7m-j728-mjw3"],"status":"published","title":"uap-core Regular Expression Denial of Service issue","description":"An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03298,"percentile":0.88587,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-185"],"published":"2019-02-13T14:00:00Z","modified":"2026-10-23T18:03:21Z","fixes":[{"ecosystem":"npm","package":"uap-core","fixed_in":["0.6.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"uap-core","fixed_in":["20190213-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"uap-core","fixed_in":["20190213-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"uap-core","fixed_in":["20190213-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"uap-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"uap-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20190213-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"uap-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20190213-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"uap-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20190213-1"}]}]},{"source":"osv","ecosystem":"npm","package":"uap-core","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.0"}]}]}],"products":[{"vendor":"uaparser","product":"user_agent_parser-core"}],"references":[{"url":"https://github.com/ua-parser/uap-core/commit/010ccdc7303546cd22b9da687c29f4a996990014","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/ua-parser/uap-core/commit/156f7e12b215bddbaf3df4514c399d683e6cdadc","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.x41-dsec.de/lab/advisories/x41-2018-009-uaparser/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/ua-parser/uap-core/issues/332","tags":["x_refsource_MISC","x_transferred","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20164","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fx7m-j728-mjw3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-20164","tags":["advisory"]},{"url":"https://github.com/ua-parser/uap-core","tags":["package"]},{"url":"https://www.x41-dsec.de/lab/advisories/x41-2018-009-uaparser","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-20164","description":"An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)","status":"published","published":"2019-02-13T14:00:00Z","modified":"2024-08-05T11:51:19.212Z","updated_at":"2026-11-02T14:34:59.872731Z"}],"euvd":[{"id":"EUVD-2019-0379","description":"An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)","status":"published","published":"2019-02-13T14:00:00Z","modified":"2024-08-05T11:51:19Z","updated_at":"2026-11-03T02:39:31.423203Z"}],"ghsa":[{"id":"GHSA-fx7m-j728-mjw3","title":"uap-core Regular Expression Denial of Service issue","description":"An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)","status":"published","published":"2019-03-06T17:35:47Z","modified":"2023-01-23T17:07:58Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-185"],"updated_at":"2026-11-02T14:36:14.033357Z"}],"nvd":[{"id":"CVE-2018-20164","description":"An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)","status":"published","published":"2019-02-13T14:29:00.24Z","modified":"2026-06-17T01:52:22.617Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-185"],"updated_at":"2026-11-02T14:04:53.728218Z"}],"osv":[{"id":"CVE-2018-20164","description":"An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)","status":"published","published":"2019-02-13T14:29:00.24Z","modified":"2026-10-20T10:48:03.613712495Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:09.145458Z"},{"id":"DEBIAN-CVE-2018-20164","description":"An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)","status":"published","published":"2019-02-13T14:29:00.24Z","modified":"2026-10-23T18:03:21.49244246Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"GHSA-fx7m-j728-mjw3","title":"uap-core Regular Expression Denial of Service issue","description":"An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)","status":"published","published":"2019-03-06T17:35:47Z","modified":"2023-11-08T04:00:11.152642Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-185"],"updated_at":"2026-11-02T15:46:47.119724Z"}]}}