Junglewise Threat Intelligence

CVE-2022-36032: ReactPHP's HTTP server parses encoded cookie names so malicious `Host-` and `Secure-` cookies can be sent

CVE-2022-36032 · Severity: low · CVSS 3.1 · Published 2022-09-16

Technologies: react/http (Packagist). Vendors: Packagist.

Executive brief

ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent

Affected products

Packagist react/http

Related threats

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedD
ReactPHP's HTTP server continues parsing unused multipart parts after reaching input field and file upload limits