CVE-2022-23496 — Vulnerability in...
HIGH
Yauaa vulnerable to ArrayIndexOutOfBoundsException triggered by a crafted Sec-Ch-Ua-Full-Version-List
Published December 8, 2022Updated January 17, 2025Source: osv
Summary
### Impact
Applications using the Client Hints analysis feature introduced with 7.0.0 can crash because the Yauaa library throws an ArrayIndexOutOfBoundsException. Applications that do not use this feature are not affected.
### Patches
Upgrade to 7.9.0
### Workarounds
Catch and discard any exceptions from Yauaa.
Advisory Timeline
- First published December 8, 2022 (1404 days ago).
- Last revised January 17, 2025 — 771 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
Maven
Update nl.basjes.parse.useragent:yauaa-beam-sql to 7.9.0 or later<!-- Update pom.xml dependency version to 7.9.0 for nl.basjes.parse.useragent:yauaa-beam-sql -->
Maven
Update nl.basjes.parse.useragent:yauaa-flink to 7.9.0 or later<!-- Update pom.xml dependency version to 7.9.0 for nl.basjes.parse.useragent:yauaa-flink -->
Maven
Update nl.basjes.parse.useragent:yauaa-hive to 7.9.0 or later<!-- Update pom.xml dependency version to 7.9.0 for nl.basjes.parse.useragent:yauaa-hive -->
Maven
Update nl.basjes.parse.useragent:yauaa to 7.9.0 or later<!-- Update pom.xml dependency version to 7.9.0 for nl.basjes.parse.useragent:yauaa -->
Maven
Update nl.basjes.parse.useragent:yauaa-logparser to 7.9.0 or later<!-- Update pom.xml dependency version to 7.9.0 for nl.basjes.parse.useragent:yauaa-logparser -->
Maven
Update nl.basjes.parse.useragent:yauaa-elasticsearch to 7.9.0 or later<!-- Update pom.xml dependency version to 7.9.0 for nl.basjes.parse.useragent:yauaa-elasticsearch -->
Maven
Update nl.basjes.parse.useragent:yauaa-drill to 7.9.0 or later<!-- Update pom.xml dependency version to 7.9.0 for nl.basjes.parse.useragent:yauaa-drill -->
Maven
Update nl.basjes.parse.useragent:yauaa-flink-table to 7.9.0 or later<!-- Update pom.xml dependency version to 7.9.0 for nl.basjes.parse.useragent:yauaa-flink-table -->
Maven
Update nl.basjes.parse.useragent:yauaa-snowflake to 7.9.0 or later<!-- Update pom.xml dependency version to 7.9.0 for nl.basjes.parse.useragent:yauaa-snowflake -->
Maven
Update nl.basjes.parse.useragent:yauaa-elasticsearch-8 to 7.9.0 or later<!-- Update pom.xml dependency version to 7.9.0 for nl.basjes.parse.useragent:yauaa-elasticsearch-8 -->
Maven
Update nl.basjes.parse.useragent:yauaa-trino to 7.9.0 or later<!-- Update pom.xml dependency version to 7.9.0 for nl.basjes.parse.useragent:yauaa-trino -->
Maven
Update nl.basjes.parse.useragent:yauaa-beam to 7.9.0 or later<!-- Update pom.xml dependency version to 7.9.0 for nl.basjes.parse.useragent:yauaa-beam -->
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (12)
Affects 1 ecosystem: maven (12).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| nl.basjes.parse.useragent:yauaa-beam-sql | maven | 7.0.0, 7.1.0, 7.2.0, 7.3.0 (+5 more) | 7.9.0 |
| nl.basjes.parse.useragent:yauaa-flink | maven | 7.0.0, 7.1.0, 7.2.0, 7.3.0 (+5 more) | 7.9.0 |
| nl.basjes.parse.useragent:yauaa-hive | maven | 7.0.0, 7.1.0, 7.2.0, 7.3.0 (+5 more) | 7.9.0 |
| nl.basjes.parse.useragent:yauaa | maven | 7.0.0, 7.1.0, 7.2.0, 7.3.0 (+5 more) | 7.9.0 |
| nl.basjes.parse.useragent:yauaa-logparser | maven | 7.0.0, 7.1.0, 7.2.0, 7.3.0 (+5 more) | 7.9.0 |
| nl.basjes.parse.useragent:yauaa-elasticsearch | maven | 7.0.0, 7.1.0, 7.2.0, 7.3.0 (+5 more) | 7.9.0 |
| nl.basjes.parse.useragent:yauaa-drill | maven | 7.0.0, 7.1.0, 7.2.0, 7.3.0 (+5 more) | 7.9.0 |
| nl.basjes.parse.useragent:yauaa-flink-table | maven | 7.0.0, 7.1.0, 7.2.0, 7.3.0 (+5 more) | 7.9.0 |
| nl.basjes.parse.useragent:yauaa-snowflake | maven | 7.0.0, 7.1.0, 7.2.0, 7.3.0 (+5 more) | 7.9.0 |
| nl.basjes.parse.useragent:yauaa-elasticsearch-8 | maven | 7.0.0, 7.1.0, 7.2.0, 7.3.0 (+5 more) | 7.9.0 |
| nl.basjes.parse.useragent:yauaa-trino | maven | 7.0.0, 7.1.0, 7.2.0, 7.3.0 (+5 more) | 7.9.0 |
| nl.basjes.parse.useragent:yauaa-beam | maven | 7.0.0, 7.1.0, 7.2.0, 7.3.0 (+5 more) | 7.9.0 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-755
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 8.6 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
References
Frequently Asked Questions
- What is CVE-2022-23496?
- Yauaa vulnerable to ArrayIndexOutOfBoundsException triggered by a crafted Sec-Ch-Ua-Full-Version-List This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.6/10).
- How do I check if my project is affected by CVE-2022-23496?
- CVE-2022-23496 affects nl.basjes.parse.useragent:yauaa-beam-sql, nl.basjes.parse.useragent:yauaa-flink and nl.basjes.parse.useragent:yauaa-hive (and 9 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2022-23496 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
8.6
High exploitability or significant impact. Prioritize remediation within days.
Also Known As
GHSA-c4pm-63cg-9j7h
Related CVEs
- CVE-2026-61570HIGH
MPXJ: XXE Vulnerability in MerlinReader
- CVE-2026-107725HIGH
Hazelcast has an authorization bypass in IMap Predicates API
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies