cve/2018/CVE-2018-20164.md

CVE-2018-20164

Description

An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)

POC

Reference

• https://www.x41-dsec.de/lab/advisories/x41-2018-009-uaparser/

Github

• https://github.com/engn33r/awesome-redos-security
• https://github.com/ossf-cve-benchmark/CVE-2018-20164