-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is caused by the error status of a misencoded header not being cleared, leading to subsequent headers being poisoned. The patch addresses this by introducing a separate field_error status that is cleared at the beginning of parsing each new header in HPackParser::Parser::ParseTop via the new HPackParser::Input::ClearFieldError function. Modifications in HPackParser::Parser::ParseHPackString and the constructors/error setting functions within HPackParser::Input support this new fine-grained error handling. The functions listed were directly involved in the vulnerable logic of parsing headers and handling their errors.
Ongoing coverage of React2Shell