{"id":"CVE-2020-5243","aliases":["GHSA-cmcx-xhr8-3w9p"],"url":"https://o3.security/vulnerability/CVE-2020-5243","summary":"Denial of Service in uap-core when processing crafted User-Agent strings","details":"### Impact\n\nSome regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.\n\n### Patches\n\nPlease update uap-core to >= v0.7.3\n\nDownstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.\n\n### Details\n\nEach vulnerable regular expression reported here contains 3 overlapping capture groups. Backtracking has approximately cubic time complexity with respect to the length of the user-agent string.\n\n#### Regex 1:\n\n```\n\\bSmartWatch *\\( *([^;]+) *; *([^;]+) *;\n```\n\nis vulnerable in portion ` *([^;]+) *` and can be attacked with\n\n```python\n"SmartWatch(" + (" " * 3500) + "z"\n```\ne.g.\n```\nSmartWatch(                                   z\n```\n\n\n#### Regex 2:\n\n```\n; *([^;/]+) Build[/ ]Huawei(MT1-U06|[A-Z]+\\d+[^\\);]+)[^\\);]*\\)\n```\n\nis vulnerable in portion `\\d+[^\\);]+[^\\);]*` and can be attacked with\n\n```python\n";A Build HuaweiA" + ("4" * 3500) + "z"\n```\n\n\n#### Regex 3:\n\n```\n(HbbTV)/[0-9]+\\.[0-9]+\\.[0-9]+ \\([^;]*; *(LG)E *; *([^;]*) *;[^;]*;[^;]*;\\)\n```\n\nis vulnerable in portion ` *([^;]*) *` and can be attacked with\n\n```python\n"HbbTV/0.0.0 (;LGE;" + (" " * 3500) + "z"\n```\n\n#### Regex 4:\n\n```\n(HbbTV)/[0-9]+\\.[0-9]+\\.[0-9]+ \\([^;]*; *(?:CUS:([^;]*)|([^;]+)) *; *([^;]*) *;.*;\n```\n\nis vulnerable in portions ` *(?:CUS:([^;]*)|([^;]+)) *` and ` *([^;]*) *` and can be attacked with\n\n```python\n"HbbTV/0.0.0 (;CUS:;" + (" " * 3500) + "z"\n"HbbTV/0.0.0 (;" + (" " * 3500) + "z"\n"HbbTV/0.0.0 (;z;" + (" " * 3500) + "z"\n```\n\nReported by Ben Caller @bcaller","published":"2020-02-21T00:15:10.960Z","modified":"2026-07-09T10:52:45.969449Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"uap-core","fixedVersion":"0.7.3"},{"ecosystem":"RubyGems","name":"user_agent_parser","fixedVersion":"2.6.0"}],"fix":{"url":"https://github.com/ua-parser/uap-core/commit/0afd61ed85396a3b5316f18bfd1edfaadf8e88e1","label":"ua-parser/uap-core@0afd61e"},"references":[{"type":"FIX","url":"https://github.com/ua-parser/uap-core/commit/0afd61ed85396a3b5316f18bfd1edfaadf8e88e1"},{"type":"EVIDENCE","url":"https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p"},{"type":"WEB","url":"https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5243"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/user_agent_parser/CVE-2020-5243.yml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-09T10:52:45.969449Z"}}