{"id":"CVE-2020-7733","aliases":["CLSA-2026-1774311649","EUVD-2021-0967","GHSA-662x-fhqg-9p8v","RHSA-2021:2865","RHSA-2021:4626","UBUNTU-CVE-2020-7733"],"status":"published","title":"Regular Expression Denial of Service (ReDoS)","description":"The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.04483,"percentile":0.91539,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2020-09-16T14:10:14Z","modified":"2026-10-20T10:54:24Z","fixes":[{"ecosystem":"npm","package":"ua-parser-js","fixed_in":["0.7.22"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"ua-parser-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.22"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"ua-parser-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.7.21-tuxcare.0"},{"fixed":"0.7.21-tuxcare.1"}]}],"versions":["0.7.21"],"bundled":3},{"source":"osv","ecosystem":"npm","package":"ua-parser-js","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.7.22"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-ui-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-1.el8ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-web-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-1.el8ev"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-ua-parser-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.14-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-ua-parser-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.14-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-ua-parser-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.24+ds-1","0.7.24+ds-2","0.7.31+ds+~0.7.36-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-ua-parser-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.1+ds+~0.7.36-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-ua-parser-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.1+ds+~0.7.36-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-ua-parser-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.1+ds+~0.7.36-3","2.0.10+ds+~cs0.3.5-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-ua-parser-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.1+ds+~0.7.36-3"]}],"products":[{"vendor":"oracle","product":"communications_cloud_native_core_network_function_cloud_native_environment"},{"vendor":"ua-parser-js_project","product":"ua-parser-js"},{"vendor":"unspecified","product":"ua-parser-js"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-UAPARSERJS-610226","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","article","report"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-674665","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBFAISALMAN-674666","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://github.com/faisalman/ua-parser-js/commit/233d3bae22a795153a7e6638887ce159c63e557d","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7733","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-662x-fhqg-9p8v"},{"url":"https://access.redhat.com/errata/RHSA-2021:2865","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1752996","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1765644","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1779983","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1804774","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1817346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1877478","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1879733","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1887434","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1888354","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1896359","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1901011","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1902179","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1937714","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1939198","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1941581","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1944286","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1945459","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1946876","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1951579","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954878","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1955582","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1956818","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1960968","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1961338","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1967169","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1970718","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2865.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7733","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7733","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28469","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28469","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28469","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23343","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23343","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23343","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23358","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23358","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23358","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4626","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1352501","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1940991","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1957830","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1971802","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1977232","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1977276","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1979730","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1989324","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1992690","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000364","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2001551","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2001944","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2007550","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2014017","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4626.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-7733","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-7733","title":"Regular Expression Denial of Service (ReDoS)","description":"The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.","status":"published","published":"2020-09-16T14:10:14.452Z","modified":"2024-09-17T04:00:09.605Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:35:58.787905Z"}],"euvd":[{"id":"EUVD-2021-0967","description":"The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.","status":"published","published":"2020-09-16T14:10:14Z","modified":"2024-09-17T04:00:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:28:26.623918Z"}],"ghsa":[{"id":"GHSA-662x-fhqg-9p8v","title":"Regular Expression Denial of Service in ua-parser-js","description":"The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.","status":"published","published":"2021-05-07T16:18:19Z","modified":"2023-01-31T05:06:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:36:29.957996Z"}],"nvd":[{"id":"CVE-2020-7733","description":"The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.","status":"published","published":"2020-09-16T14:15:15.033Z","modified":"2026-06-17T03:25:20.787Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:06:15.83396Z"}],"osv":[{"id":"CVE-2020-7733","description":"The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.","status":"published","published":"2020-09-16T14:15:15.033Z","modified":"2026-10-20T10:54:24.837695446Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:17.34531Z"},{"id":"GHSA-662x-fhqg-9p8v","title":"Regular Expression Denial of Service in ua-parser-js","description":"The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.","status":"published","published":"2021-05-07T16:18:19Z","modified":"2025-01-14T08:57:11.858219Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"RHSA-2021:2865","title":"Red Hat Security Advisory: RHV Manager (ovirt-engine) security update [ovirt-4.4.7]","status":"published","published":"2024-09-18T04:19:09Z","modified":"2026-10-14T10:01:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:4626","title":"Red Hat Security Advisory: RHV Manager (ovirt-engine) security update [ovirt-4.4.9]","status":"published","published":"2024-09-18T04:21:21Z","modified":"2026-10-14T10:01:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"UBUNTU-CVE-2020-7733","description":"The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.","status":"published","published":"2020-09-16T14:15:00Z","modified":"2026-10-17T12:56:14.601894641Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"CLSA-2026-1774311649","title":"TuxCare security update for ua-parser-js (3 CVEs)","description":"TuxCare rebuilt ua-parser-js to address 3 CVEs. Fixed in 0.7.21-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:47:05.280926668Z","updated_at":"2026-11-02T15:43:43.621843Z"}]}}