GitHub Advisoryadvisory · Packagist

GHSA-9jxr-mwpp-w643 Improper header validation in httpsoft/http-message

MEDIUM Published 2023-04-21 Modified 2023-04-21 Official page ↗
Ecosystem
Packagist
Packages
httpsoft/http-message
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-436
Reviewed
2023-04-21

Affected packages

• Packagist httpsoft/http-message: < 1.0.12 → fixed in 1.0.12

Description

Impact Improper header parsing. An attacker could sneak in a newline (`\n`) into both the header names and values. While the specification states that `\r\n\r\n` is used to terminate the header list, many servers in the wild will also accept `\n\n`. Patches The issue is patched in 1.0.12. Workarounds There are no known workarounds. References • https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4

Related

Weakness · CWE (1)

  • CWE-436 Interpretation Conflict weakness

References