CVEvulnerability

CVE-2023-29530

6.5 MEDIUM Published 2023-04-24 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-04-24
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20

Description

Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users who create HTTP requests or responses using laminas/laminas-diactoros, when providing a newline at the start or end of a header key or value, can cause an invalid message. This can lead to denial of service vectors or application errors. The problem has been patched in following versions 2.18.1, 2.19.1, 2.20.1, 2.21.1, 2.22.1, 2.23.1, 2.24.1, and 2.25.1. As a workaround, validate HTTP header keys and/or values, and if using user-supplied values, filter them to strip off leading or trailing newline characters before calling `withHeader()`.

Affected configurations

• getlaminas laminas-diactoros (< 2.18.1) • getlaminas laminas-diactoros 2.19.0 • getlaminas laminas-diactoros 2.20.0 • getlaminas laminas-diactoros 2.21.0 • getlaminas laminas-diactoros 2.22.0 • getlaminas laminas-diactoros 2.23.0 • getlaminas laminas-diactoros 2.24.0 • getlaminas laminas-diactoros 2.25.0 • guzzlephp psr-7 (< 1.9.1) • guzzlephp psr-7 (>= 2.0.0 < 2.4.5) • fedoraproject fedora 38

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References