Medium [CVE-2026-48125] Denial of Service via crafted Client Hints header
This medium-severity Red Hat Linux advisory covers CVE-2026-48125 affecting Gatekeeper 3, Migration Toolkit for Containers, Red Hat Build of Podman Desktop.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API.
By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause excessive CPU time due to catastrophic backtracking in the device regex because Client Hints values are copied without the UA_MAX_LENGTH limit used for User-Agent values. This issue is fixed in version 2.0.10.
A flaw was found in UAParser.js, a JavaScript library for detecting client information. This can cause excessive CPU usage due to a regular expression denial-of-service (ReDoS) issue, leading to a denial of service for the affected application.
Mobile browsers send this hint to inform servers about the specific device model. Servers use the model name to tailor content, apply device-specific optimizations, or log analytics about which hardware models access a service.
A single request with a ~32,000-character model value can consume over 400ms of CPU time, with parsing time growing polynomially with input length. The impact is availability only, there is no confidentiality or integrity impact.
Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-1333.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 6 days ago·verify at source
Mitigation checklist
- If you are managing web servers or Node.js applications that process user-agent information, you can defend against this attack vector using the following approaches: * Apply header length restrictions (reverse proxy, WAF, application) * Opt-out of Client Hints, avoid parsing the Sec-CH-UA-Model with ua-parser-js npm package Upgrading to version 2.0.10+ mitigates this issue, by setting a maximum cap size of UA_MAX_LENGTH = 500.
Official advisory · high-confidence parse· fetched 6 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.