CVE-2023-26044

Packagist/react/http CVE-2023-26044: medium 5.3

ReactPHP's HTTP server continues parsing unused multipart parts after reaching input field and file upload limits

Action: Upgrade react/http to 1.9.0 or later.

composer require react/http:1.9.0

Affected

Fixed versions

Sources

• osv: GHSA-95x4-j7vc-h8mf
• https://github.com/php/php-src/security/advisories/GHSA-54hq-v5wp-fqgv
• https://github.com/reactphp/http/security/advisories/GHSA-95x4-j7vc-h8mf
• https://nvd.nist.gov/vuln/detail/CVE-2023-26044
• https://github.com/php/php-src/commit/716de0cff539f46294ef70fe75d548cd66766370#diff-81d659aa9e83177ac08151f99cebf21ab331d22462c72a1039f59947e66f5a35
• https://github.com/reactphp/http/commit/9681f764b80c45ebfb5fe2ea7da5bd3babfcdcfd
• https://github.com/FriendsOfPHP/security-advisories/blob/master/react/http/CVE-2023-26044.yaml
• https://github.com/advisories/GHSA-95x4-j7vc-h8mf
• https://github.com/reactphp/http
• https://github.com/reactphp/http/releases/tag/v1.9.0

CVE-2023-26044 · published 2023-05-17T17:07:57Z · modified 2024-02-16T08:21:37.735453Z · JSON