GitHub Advisoryadvisory · RubyGems

GHSA-pcqq-5962-hvcw Denial of Service in uap-core when processing crafted User-Agent strings

HIGH Published 2020-03-10 Modified 2025-05-22 Official page ↗
Ecosystem
RubyGems
Packages
user_agent_parser
Severity
High
Reviewed
2020-03-10

Affected packages

• RubyGems user_agent_parser: < 2.6.0 → fixed in 2.6.0

Description

Impact Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. Patches Please update `uap-ruby` to &gt;= v2.6.0 For more information https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p Reported in `uap-core` by Ben Caller @bcaller

References