What is GHSA-pcqq-5962-hvcw?

GHSA-pcqq-5962-hvcw is a security advisory published by GitHub Security Advisories with High severity. Denial of Service in uap-core when processing crafted User-Agent strings

Why does GHSA-pcqq-5962-hvcw have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-pcqq-5962-hvcw?

GHSA-pcqq-5962-hvcw affects 1 product, including: rubygems/user_agent_parser:\u003c 2.6.0.

GHSA-pcqq-5962-hvcwHighDisclosed before NVD

Denial of Service in uap-core when processing crafted User-Agent strings

Vendor

GitHub Security Advisories

Published

March 10, 2020

Last Modified

May 22, 2025

📋 Description

Impact

Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.

Patches

Please update uap-ruby to >= v2.6.0

For more information

https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p

Reported in uap-core by Ben Caller @bcaller

🎯 Affected products1

rubygems/user_agent_parser:< 2.6.0

🔗 References (4)

https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw
https://github.com/ua-parser/uap-ruby/commit/2bb18268f4c5ba7d4ba0e21c296bf6437063da3a
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/user_agent_parser/GHSA-pcqq-5962-hvcw.yml
https://github.com/advisories/GHSA-pcqq-5962-hvcw