https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T23:32:47.046373+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-36468 EUVD-2026-36468 2026-10-12T23:32:47.066913+00:00 EUVD-2026-36468 https://cve.radiocsirt.org/vuln/fkie_cve-2020-5243 fkie_cve-2020-5243 2026-10-12T23:32:47.066951+00:00

uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This has been patched in uap-core 0.7.3.

 https://cve.radiocsirt.org/vuln/ghsa-cmcx-xhr8-3w9p GHSA-cmcx-xhr8-3w9p — Denial of Service in uap-core when processing crafted User-Agent strings 2026-10-12T23:32:47.066993+00:00

Affected: npm: uap-core, RubyGems: user_agent_parser

### Impact

Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.

### Patches

Please update uap-core to >= v0.7.3

Downstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.

### Details

Each vulnerable regular expression reported here contains 3 overlapping capture groups. Backtracking has approximately cubic time complexity with respect to the length of the user-agent string.

#### Regex 1:

``` \bSmartWatch *\( *([^;]+) *; *([^;]+) *; ```

is vulnerable in portion ` *([^;]+) *` and can be attacked with

```python "SmartWatch(" + (" " * 3500) + "z" ``` e.g. ``` SmartWatch( z ```

#### Regex 2:

``` ; *([^;/]+) Build[/ ]Huawei(MT1-U06|[A-Z]+\d+[^\);]+)[^\);]*\) ```

is vulnerable in portion `\d+[^\);]+[^\);]*` and can be attacked with

```python ";A Build HuaweiA" + ("4" * 3500) + "z" ```

#### Regex 3:

``` (HbbTV)/[0-9]+\.[0-9]+\.[0-9]+ \([^;]*; *(LG)E *; *([^;]*) *;[^;]*;[^;]*;\) ```

is vulnerable in portion ` *([^;]*) *` and can be attacked with

```python "HbbTV/0.0.0 (;LGE;" + (&quo…

 https://cve.radiocsirt.org/vuln/gsd-2020-5243 gsd-2020-5243 2026-10-12T23:32:47.067077+00:00 gsd-2020-5243 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-5243 UBUNTU-CVE-2020-5243 2026-10-12T23:32:47.067097+00:00

Affected: Ubuntu:20.04:LTS: uap-core, Ubuntu:22.04:LTS: uap-core, Ubuntu:24.04:LTS: uap-core, Ubuntu:25.10: uap-core, Ubuntu:26.04:LTS: uap-core

uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This has been patched in uap-core 0.7.3.