CVE-2022-23496

    Dashboard / Vulnerabilities / CVE-2022-23496

    CVE-2022-23496

    Published: 8 Dec 2022Last Modified: 12 Aug 2026

    Summary: A crafted list can trigger a ArrayIndexOutOfBoundsException in Yauaa

    Details: Yet Another UserAgent Analyzer (Yauaa) is a java library that tries to parse and analyze the useragent string and extract as many relevant attributes as possible. Applications using the Client Hints analysis feature introduced with 7.0.0 can crash because the Yauaa library throws an ArrayIndexOutOfBoundsException. If uncaught the exception will result in a program crash. Applications that do not use this feature are not affected. Users are advised to upgrade to version 7.9.0. Users unable to upgrade may catch and discard any ArrayIndexOutOfBoundsException thrown by the Yauaa library.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23496.json, https://github.com/nielsbasjes/yauaa/security/advisories/GHSA-c4pm-63cg-9j7h, https://nvd.nist.gov/vuln/detail/CVE-2022-23496, https://github.com/nielsbasjes/yauaa/commit/3017a866e2cff0d308f264b66fde4fa79e3beb9e

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 3841b63cfb546c6ffaeea84483b29b3b676a9d97
    Fixed -755736ffb21cc18a26fae7bbfdf2d461d34c9034

    Affected versions

    v7.8.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-23496 | CVE-DB