Denial of Service in uap-core when processing crafted User-Agent strings
Description
Reviewed
Mar 10, 2020
Published to the GitHub Advisory Database
Mar 10, 2020
Last updated
Jan 9, 2023
Impact
Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.
Patches
Please update
uap-ruby
to >= v2.6.0For more information
GHSA-cmcx-xhr8-3w9p
Reported in
uap-core
by Ben Caller @bcallerReferences