Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

react/http

4 known vulnerabilities (2 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 2 high, 2 medium
Registry
Packagist

Advisories 4

  • react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

    Affected: from 1.0.0, fixed in 1.11.1.

  • react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

    Affected: from 0.6.0, fixed in 1.11.1.

  • CVE-2023-26044Medium 5.3

    ReactPHP's HTTP server continues parsing unused multipart parts after reaching limits

    Affected: from 0.8.0, fixed in 1.9.0.

  • CVE-2022-36032Medium 5.3

    ReactPHP's HTTP server parses encoded cookie names so malicious `Host-` and `Secure-` cookies can be sent

    Affected: from 0.7.0, fixed in 1.7.0.