-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from the page error handler's ability to trigger recursive requests when resolving error pages. The unpatched version of handlePageError() in PageContentErrorHandler.php did not include the critical check comparing $resolvedUrl to the current request URI. This allowed attackers to craft requests that forced the server to repeatedly process the same error-handling logic, creating a denial-of-service condition. The security patch explicitly adds this check (if ($resolvedUrl === (string)$request->getUri())) to break the recursion chain, confirming this function's central role in the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms-core | composer | >= 11.4.0, < 11.5.16 | 11.5.16 |
| typo3/cms | composer | >= 11.4.0, < 11.5.16 | 11.5.16 |
Ongoing coverage of React2Shell