Packagist/spiral/roadrunner CVE-2025-22871: critical 9.1, EPSS 0.83%
RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency
Action: Upgrade spiral/roadrunner to 2025.1.0 or later.
composer require spiral/roadrunner:2025.1.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2025.1.0 | - |
Fixed versions
| 2025.1.0 |
Sources
- osv: GHSA-g9pc-8g42-g6vq
- https://nvd.nist.gov/vuln/detail/CVE-2025-22871
- https://github.com/roadrunner-server/roadrunner/issues/2166
- https://github.com/roadrunner-server/roadrunner/commit/f269279ee87d0b88127741cad1042389af7605fa
- https://cert-portal.siemens.com/productcert/html/ssa-783943.html
- https://github.com/roadrunner-server/roadrunner
- https://github.com/roadrunner-server/roadrunner/releases/tag/v2025.1.0
- https://go.dev/cl/652998
- https://go.dev/issue/71988
- https://groups.google.com/g/golang-announce/c/Y2uBTVKjBQk
- https://pkg.go.dev/vuln/GO-2025-3563
- http://www.openwall.com/lists/oss-security/2025/04/04/4
CVE-2025-22871 · published · modified · JSON