CyberRota Analysis
AI-GeneratedThe UAParser.js library versions 2.0.1 to 2.0.10 are vulnerable to a regular expression denial-of-service attack when using the Client Hints API, which can lead to excessive CPU consumption due to catastrophic backtracking triggered by a specially crafted Sec-CH-UA-Model header. This vulnerability primarily affects applications that utilize UAParser.js for parsing user-agent data. Developers and security teams using affected versions should prioritize upgrading to version 2.0.10 to mitigate the risk of service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause excessive CPU time due to catastrophic backtracking in the device regex because Client Hints values are copied without the UA_MAX_LENGTH limit used for User-Agent values. This issue is fixed in version 2.0.10.
Related CVEs
Other vulnerabilities affecting the same vendor(s)