Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2020-5243 Details

Description

uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This has been patched in uap-core 0.7.3.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/ua-parser/uap-core/commit/0afd61ed85396a3b5316f18bfd1edfaadf8e88e1 CVEPatch
https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p CVEExploitThird Party Advisory
https://github.com/ua-parser/uap-core/commit/0afd61ed85396a3b5316f18bfd1edfaadf8e88e1 [email protected]Patch
https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p [email protected]ExploitThird Party Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-1333Inefficient Regular Expression Complexity[email protected]
CWE-20Improper Input Validation[email protected]

Affected Products

ProductVersions
uap-core project uap-core
< 0.7.3

CPE

  • cpe:2.3:a:uap-core_project:uap-core:*:*:*:*:*:node.js:*:*

Remediation

  • No remediation found in references.

Change History

5 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2020-5243
NVD Published Date:
Feb 21, 2020
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2020-5243 Details - Not Deferred