p PatchFirst

PatchFirst · Latest vulnerabilities

laminas/laminas-diactoros vulnerabilities

Vulnerabilities published for laminas/laminas-diactoros in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 2

  1. CVE-2023-29530

    High · CVSS 7.5EPSS 0.97%Fix available

    Laminas Diactoros vulnerable to HTTP Multiline Header Termination

    Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users who create HTTP requests or responses using laminas/laminas-diactoros, when providing a newline at the start or end of a header key or value, can cause an invalid message. This can lead to denial of service vectors or application errors. The problem has been patched in following versions 2.18.1, 2.19.1, 2.20.1, 2.21.1, 2.22.1, 2.23.1, 2.24.1, and 2.25.1. As a workaround, validate HTTP header keys and/or values, and if using user-supplied values, filter them to strip off leading or trailin

    laminas/laminas-diactoros laminas/laminas-diactoros laminas/laminas-diactoros laminas/laminas-diactoros laminas/laminas-diactoros laminas/laminas-diactoros laminas/laminas-diactoros laminas/laminas-diactorosPHP
    • Update to 2.18.1
    • Update to 2.19.1
    • Update to 2.20.1
    • Update to 2.21.1
    • Update to 2.22.1
    • Update to 2.23.1
    • Update to 2.24.2
    • Update to 2.25.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2022-31109

    High · CVSS 7.2EPSS 0.8%Fix available

    HTTP Host Header Attack Vulnerability in laminas-diactoros

    laminas-diactoros is a PHP package containing implementations of the PSR-7 HTTP message interfaces and PSR-17 HTTP message factory interfaces. Applications that use Diactoros, and are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a `Laminas\Diactoros\Uri` instance associated with the incoming server request modified to reflect values from `X-Forwarded-*` headers. Such changes can potentially lead to XSS attacks (if a fully-qualified URL is used in links) and/or URL poisoning. Since the `X-Forwarded-*` headers do have valid use cases, particularly in clustered envir

    laminas/laminas-diactorosPHP
    • Update to 2.11.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →