CVE-2023-26044

The CVE-2023-26044 issue affects ReactPHP’s HTTP server component (react/http). Previous releases allow a DoS via processing very large request bodies, causing high CPU usage; impact is limited in default configs but manifests when RequestBodyBufferMiddleware is configured with large limits. The ...

CVE-2022-36032

CVE-2022-36032 affects ReactPHP HTTP server component versions 0.7.0 up to, but not including, 1.7.0. When processing incoming HTTP cookie values, cookie names are url-decoded, which can cause cookies with prefixes like __Host- and __Secure- to be confounded with decodings of other cookies. This ...