{"id":"GHSA-cmcx-xhr8-3w9p","summary":"Denial of Service in uap-core when processing crafted User-Agent strings","details":"### Impact\n\nSome regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.\n\n### Patches\n\nPlease update uap-core to >= v0.7.3\n\nDownstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.\n\n### Details\n\nEach vulnerable regular expression reported here contains 3 overlapping capture groups. Backtracking has approximately cubic time complexity with respect to the length of the user-agent string.\n\n#### Regex 1:\n\n```\n\\bSmartWatch *\\( *([^;]+) *; *([^;]+) *;\n```\n\nis vulnerable in portion ` *([^;]+) *` and can be attacked with\n\n```python\n"SmartWatch(" + (" " * 3500) + "z"\n```\ne.g.\n```\nSmartWatch(                                   z\n```\n\n\n#### Regex 2:\n\n```\n; *([^;/]+) Build[/ ]Huawei(MT1-U06|[A-Z]+\\d+[^\\);]+)[^\\);]*\\)\n```\n\nis vulnerable in portion `\\d+[^\\);]+[^\\);]*` and can be attacked with\n\n```python\n";A Build HuaweiA" + ("4" * 3500) + "z"\n```\n\n\n#### Regex 3:\n\n```\n(HbbTV)/[0-9]+\\.[0-9]+\\.[0-9]+ \\([^;]*; *(LG)E *; *([^;]*) *;[^;]*;[^;]*;\\)\n```\n\nis vulnerable in portion ` *([^;]*) *` and can be attacked with\n\n```python\n"HbbTV/0.0.0 (;LGE;" + (" " * 3500) + "z"\n```\n\n#### Regex 4:\n\n```\n(HbbTV)/[0-9]+\\.[0-9]+\\.[0-9]+ \\([^;]*; *(?:CUS:([^;]*)|([^;]+)) *; *([^;]*) *;.*;\n```\n\nis vulnerable in portions ` *(?:CUS:([^;]*)|([^;]+)) *` and ` *([^;]*) *` and can be attacked with\n\n```python\n"HbbTV/0.0.0 (;CUS:;" + (" " * 3500) + "z"\n"HbbTV/0.0.0 (;" + (" " * 3500) + "z"\n"HbbTV/0.0.0 (;z;" + (" " * 3500) + "z"\n```\n\nReported by Ben Caller @bcaller","aliases":["CVE-2020-5243"],"modified":"2026-05-07T05:03:07.422530062Z","published":"2020-02-20T23:26:10Z","database_specific":{"github_reviewed_at":"2020-02-20T23:09:32Z","nvd_published_at":"2020-02-21T00:15:10Z","cwe_ids":["CWE-1333","CWE-20"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p"},{"type":"WEB","url":"https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5243"},{"type":"WEB","url":"https://github.com/ua-parser/uap-core/commit/0afd61ed85396a3b5316f18bfd1edfaadf8e88e1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/user_agent_parser/CVE-2020-5243.yml"}],"affected":[{"package":{"name":"uap-core","ecosystem":"npm","purl":"pkg:npm/uap-core"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.7.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/02/GHSA-cmcx-xhr8-3w9p/GHSA-cmcx-xhr8-3w9p.json"}},{"package":{"name":"user_agent_parser","ecosystem":"RubyGems","purl":"pkg:gem/user_agent_parser"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0"}]}],"versions":["0.1.0","0.1.1","0.1.2","1.0.0","1.0.1","1.0.2","2.0.0","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.2.0","2.3.0","2.3.1","2.3.2","2.4.0","2.4.1","2.5.0","2.5.1","2.5.2","2.5.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/02/GHSA-cmcx-xhr8-3w9p/GHSA-cmcx-xhr8-3w9p.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H"}]}