AIKIDO-2026-11006
mobiledetect/mobiledetectlib is vulnerable to Uncontrolled Resource Consumption
59
Medium Risk
This Affects:
mobiledetect/mobiledetectlibTL;DR
The bundled in-memory Detection\Cache\Cache used by default MobileDetect instances could grow without a cardinality limit when the same object is reused across many distinct User-Agent values in long-running PHP workers. An attacker sending many unique User-Agent strings can cause sustained memory growth and eventual worker exhaustion. Versions before 4.11.0 keep every distinct cache key until process end unless operators inject a bounded external PSR-16 backend. Release 4.11.0 adds a default cap of 1000 entries with FIFO eviction on new keys.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
mobiledetect/mobiledetectlib is vulnerable to Uncontrolled Resource Consumption in versions 4.8.04 - 4.10.0.
How to fix this
Upgrade the mobiledetect/mobiledetectlib library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.