GHSA-78hm-5hjw-58mh: 
PHP vulnerability analysis and mitigation

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in ua-parser/uap-php versions prior to 3.8.0. The vulnerability was identified on December 14, 2018, affecting the PHP implementation of the User Agent Parser library (GitHub Advisory).

The vulnerability stems from a problematic regex pattern implementation that could lead to catastrophic backtracking. The issue was specifically related to nested repetition operators in regular expressions, such as using (\d+)? pattern, which could cause exponential processing time with certain inputs (Core PR).

When exploited, this vulnerability could cause denial of service through excessive CPU consumption when processing specially crafted user agent strings, potentially affecting the availability of applications using the vulnerable versions of the library (GitHub Advisory).

The vulnerability is classified as having moderate severity. It requires an attacker to send specifically crafted user agent strings to an application using the vulnerable version of ua-parser/uap-php (GitHub Advisory).

The vulnerability was patched in version 3.8.0 of ua-parser/uap-php. Users should upgrade to this version or later to address the ReDoS vulnerability. The fix involved modifying regex patterns to avoid nested repetition operators, replacing patterns like (\d+)? with safer alternatives such as (\d+|) (Core PR).