-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| react/http | composer | >= 0.8.0, < 1.9.0 | 1.9.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the multipart parser continuing to process parts even after application-level limits (like max_input_vars) are reached. The ReactPHP patch introduced a maxMultipartBodyParts limit (based on PHP's fix for CVE-2023-0662), tracked via $multipartBodyPartCount in parseBody. Pre-patch versions lacked this counter, allowing unbounded parsing. The parseBody method's loop (before the patch) didn't break when limits were exceeded, leading to uncontrolled resource consumption.
A Semantic Attack on Google Gemini - Read the Latest Research