Skip to content
VulniPulse
Sign in
Advisory severityMedium5.3Red Hat Linux

Medium [CVE-2026-48125] Denial of Service via crafted Client Hints header

This medium-severity Red Hat Linux advisory covers CVE-2026-48125 affecting Gatekeeper 3, Migration Toolkit for Containers, Red Hat Build of Podman Desktop.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-48125 Source published Source updated

VulniPulse record published Record updated

CVE-2026-48125
Affected products & platforms
Red Hat LinuxRed Hat Enterprise Linux
Open source advisory

Summary

UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API.

By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause excessive CPU time due to catastrophic backtracking in the device regex because Client Hints values are copied without the UA_MAX_LENGTH limit used for User-Agent values. This issue is fixed in version 2.0.10.

A flaw was found in UAParser.js, a JavaScript library for detecting client information. This can cause excessive CPU usage due to a regular expression denial-of-service (ReDoS) issue, leading to a denial of service for the affected application.

Mobile browsers send this hint to inform servers about the specific device model. Servers use the model name to tailor content, apply device-specific optimizations, or log analytics about which hardware models access a service.

A single request with a ~32,000-character model value can consume over 400ms of CPU time, with parsing time growing polynomially with input length. The impact is availability only, there is no confidentiality or integrity impact.

Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-1333.

Is CVE-2026-48125 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-48125 is not in the CISA KEV catalog (checked ) and this advisory does not report exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-48125?

Upgrade to a fixed release named by Red Hat:

  • 2.0.10

Confirm against the vendor advisory before you patch.

Affected versions

No affected-version range was extracted from the source record. The vendor advisory is authoritative. Check it before change work.

Official advisory · high-confidence parse· fetched 6 days ago·verify at source

Fixed versions
  • 2.0.10

Official advisory · high-confidence parse· fetched 6 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • If you are managing web servers or Node.js applications that process user-agent information, you can defend against this attack vector using the following approaches: * Apply header length restrictions (reverse proxy, WAF, application) * Opt-out of Client Hints, avoid parsing the Sec-CH-UA-Model with ua-parser-js npm package Upgrading to version 2.0.10+ mitigates this issue, by setting a maximum cap size of UA_MAX_LENGTH = 500.

Official advisory · high-confidence parse· fetched 6 days ago·verify at source

Get an email when Red Hat RHEL & SELinux publishes the next one.

See Red Hat RHEL & SELinux's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Red Hat RHEL & SELinux

More Red Hat Linux advisories

All Red Hat Linux advisories

iPhone and Android apps · New on the App Store

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Download on the App StoreGet CVE alerts on AndroidSee app features

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.