| Version | Supported |
|---|---|
| 1.x | Yes |
| < 1.0 | No |
If you discover a security vulnerability in go-ua-parser, please report it responsibly.
Do not open a public GitHub issue for security vulnerabilities.
Instead, please report via one of these methods:
- GitHub Security Advisories: Use the Security tab to create a private advisory
- Email: Send details to the repository maintainers
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
- Acknowledgment: Within 48 hours
- Assessment: Within 1 week
- Fix: Dependent on severity, typically within 2 weeks for critical issues
This library parses untrusted User-Agent strings. Relevant security concerns include:
- Denial of Service: Maliciously crafted UA strings that cause excessive CPU or memory usage
- Panic/crash: Input that causes an unrecovered panic
- Memory safety: Buffer overflows or out-of-bounds access
The library is fuzz-tested to mitigate these risks. If you find a UA string that triggers any of the above, that is a valid security report.
- UA spoofing (users can send any UA string — this is by design)
- Incorrect parsing results (these are bugs, not security issues — use regular GitHub Issues)