Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
React\Http\Browser and its lower-level HTTP stack impose no limit on the size of a response's header section while it is being received. ClientRequestStream::handleData() appends every incoming byte to an internal buffer and only scans that buffer for the \r\n\r\n (or \n\n) terminator, without ever checking its length. A remote server that withholds the terminator and keeps streaming can grow the client's memory without bound until PHP's memorylimit is exhausted and the process crashes. This is an unauthenticated, network-reachable denial of service against any application that uses react/http as a client to fetch untrusted or attacker-influenced URLs, including via redirects. Details ClientRequestStream::handleData() is bound directly to the underlying connection's data event, so every byte the peer sends is appended with no size check: The only exit from the buffering state is finding the header terminator or a connection close, so until it arrives the buffer grows…
Recommended action: Upgrade to 1.11.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A malformed HTTP message using Transfer-Encoding: chunked can drive React\Http\Io\ChunkedDecoder into an infinite loop, pegging a CPU core and freezing the event loop. Because ReactPHP is single-threaded, one such message stalls the entire process for every client until it is killed. Both directions are affected. ChunkedDecoder decodes chunked request bodies for React\Http\HttpServer and chunked response bodies for React\Http\Browser, so a server can be attacked by a malicious client and a client can be attacked by a malicious or compromised server. Details ChunkedDecoder::handleData() loops while ($this-buffer !== '') and relies on the buffer shrinking each iteration. Two states leave the buffer unchanged while the loop condition stays true. Terminal-chunk trailer. After the terminating 0 chunk, any remaining buffer is treated as trailer data to skip: When the trailer holds no CRLF yet, strpos() returns false, PHP coerces that to 0 in substr(), and the buffer is never…
Recommended action: Upgrade to 1.11.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Previous versions of ReactPHP's HTTP server component contain a potential DoS vulnerability that can cause high CPU load when processing large HTTP request bodies. This vulnerability has little to no impact on the default configuration, but can be exploited when explicitly using the RequestBodyBufferMiddleware with very large settings. This might lead to consuming large amounts of CPU time for processing requests and significantly delay or slow down the processing of legitimate user requests. Patches The supplied patch resolves this vulnerability for ReactPHP. Workarounds - Keeping the request body limit using RequestBodyBufferMiddleware sensible will mitigate it. - Infrastructure or DevOps can place a reverse proxy in front of the ReactPHP HTTP server to filter out any excessive HTTP request bodies. References A similar vulnerability was discovered in PHP recently, see also PHP's security advisory (CVE-2023-0662). The fix is based on the PHP-FPM fix.
Recommended action: Upgrade to 1.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact In ReactPHP's HTTP server component versions below v1.7.0, when ReactPHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like Host- and Secure- confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-7070 and CVE-2020-8184 for more information. Patches https://github.com/reactphp/http/commit/663c9a3b77b71463fa7fcb76a6676ffd16979dd6 - Fixed in reactphp/http v1.7.0 Workarounds Infrastructure or DevOps can place a reverse proxy in front of the ReactPHP HTTP server to filter out any unexpected Cookie request headers. References CVE-2020-7070, https://bugs.php.net/bug.php?id=79699 and https://github.com/php/php-src/commit/6559fe912661ca5ce5f0eeeb591d928451428ed0 CVE-2020-8184, https://hackerone.com/reports/895727 and https://github.com/rack/rack/commit/1f5763de6a9fe515ff84992b343d63c88104654c Originally introduced via…
Recommended action: Upgrade to 1.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.