CVE-2022-23496 json
A crafted list can trigger a ArrayIndexOutOfBoundsException in Yauaa
published 2022-12-08 3 y ago modified 2026-06-17 4 mo ago also GHSA-c4pm-63cg-9j7h , EUVD-2022-7593
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
Yet Another UserAgent Analyzer (Yauaa) is a java library that tries to parse and analyze the useragent string and extract as many relevant attributes as possible. Applications using the Client Hints analysis feature introduced with 7.0.0 can crash because the Yauaa library throws an ArrayIndexOutOfBoundsException. If uncaught the exception will result in a program crash. Applications that do not use this feature are not affected. Users are advised to upgrade to version 7.9.0. Users unable to upgrade may catch and discard any ArrayIndexOutOfBoundsException thrown by the Yauaa library.
Patch / fix
- maven nl.basjes.parse.useragent:yauaa 7.9.0
- maven nl.basjes.parse.useragent:yauaa-beam 7.9.0
- maven nl.basjes.parse.useragent:yauaa-beam-sql 7.9.0
- maven nl.basjes.parse.useragent:yauaa-drill 7.9.0
- maven nl.basjes.parse.useragent:yauaa-elasticsearch 7.9.0
- maven nl.basjes.parse.useragent:yauaa-elasticsearch-8 7.9.0
- maven nl.basjes.parse.useragent:yauaa-flink 7.9.0
- maven nl.basjes.parse.useragent:yauaa-flink-table 7.9.0
- maven nl.basjes.parse.useragent:yauaa-hive 7.9.0
- maven nl.basjes.parse.useragent:yauaa-logparser 7.9.0
- maven nl.basjes.parse.useragent:yauaa-snowflake 7.9.0
- maven nl.basjes.parse.useragent:yauaa-trino 7.9.0
- yet_another_useragent_analyzer_project yet_another_useragent_analyzer 7.9.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.80% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | nl.basjes.parse.useragent:yauaa | >=7.0.0, <7.9.0 |
7.9.0 |
| maven | nl.basjes.parse.useragent:yauaa-beam | >=7.0.0, <7.9.0 |
7.9.0 |
| maven | nl.basjes.parse.useragent:yauaa-beam-sql | >=7.0.0, <7.9.0 |
7.9.0 |
| maven | nl.basjes.parse.useragent:yauaa-drill | >=7.0.0, <7.9.0 |
7.9.0 |
| maven | nl.basjes.parse.useragent:yauaa-elasticsearch | >=7.0.0, <7.9.0 |
7.9.0 |
| maven | nl.basjes.parse.useragent:yauaa-elasticsearch-8 | >=7.0.0, <7.9.0 |
7.9.0 |
| maven | nl.basjes.parse.useragent:yauaa-flink | >=7.0.0, <7.9.0 |
7.9.0 |
| maven | nl.basjes.parse.useragent:yauaa-flink-table | >=7.0.0, <7.9.0 |
7.9.0 |
| maven | nl.basjes.parse.useragent:yauaa-hive | >=7.0.0, <7.9.0 |
7.9.0 |
| maven | nl.basjes.parse.useragent:yauaa-logparser | >=7.0.0, <7.9.0 |
7.9.0 |
| maven | nl.basjes.parse.useragent:yauaa-snowflake | >=7.0.0, <7.9.0 |
7.9.0 |
| maven | nl.basjes.parse.useragent:yauaa-trino | >=7.0.0, <7.9.0 |
7.9.0 |
Affected products
- nielsbasjes yauaa
Classification
- Weakness
-
- CWE-755 Improper Handling of Exceptional Conditions
References
-
github.com
/nielsbasjes/yauaa/commit/3017a866e2cff0d308f264b66fde4fa79e3beb9e
web, patch, third-party-advisory
-
github.com
/nielsbasjes/yauaa/security/advisories/GHSA-c4pm-63cg-9j7h
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-23496
advisory
-
github.com
/nielsbasjes/yauaa
package
Sources
- CVE List CVE-2022-23496
- GitHub Advisory GHSA-c4pm-63cg-9j7h
- NVD CVE-2022-23496
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.