GHSA-pcqq-5962-hvcw: 
Ruby vulnerability analysis and mitigation

A high-severity vulnerability (GHSA-pcqq-5962-hvcw) was discovered in uap-core affecting versions prior to 2.6.0 of the uap-ruby package. The vulnerability was published on March 6, 2020, and was identified as CVE-2020-5243. The issue affects the User-Agent string processing functionality in the uap-core library, which is used by the uap-ruby package (GitHub Advisory).

The vulnerability stems from overlapping capture groups in regular expressions within the uap-core library. This implementation flaw makes the system susceptible to Regular Expression Denial of Service (REDoS) attacks. The issue was discovered by security researcher Ben Caller (@bcaller) and received a high severity rating (GitHub Advisory).

When exploited, this vulnerability allows remote attackers to cause a Denial of Service condition by overloading the server. This is achieved by sending HTTP(S) requests containing maliciously crafted long strings in the User-Agent header (GitHub Advisory).

Users are advised to update their uap-ruby installation to version 2.6.0 or later, which contains the necessary fixes for this vulnerability. This update includes a patched version of uap-core that addresses the REDoS vulnerability (GitHub Advisory).