Junglewise Threat Intelligence

CVE-2023-26044: ReactPHP's HTTP server continues parsing unused multipart parts after reaching input field and file upload limits

CVE-2023-26044 · Severity: low · CVSS 3.1 · Published 2023-05-17

Technologies: react/http (Packagist). Vendors: Packagist.

Executive brief

ReactPHP's HTTP server continues parsing unused multipart parts after reaching input field and file upload limits

Affected products

Packagist react/http

Related threats

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedD
ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent