Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

reactphp/http

              3.x @ 4e1b4f3
            

Fixes

CVEs

HIGH

Peak severity

66.7%

Coverage

Highlights

Denial of Service: 5 prior fixes. Scrutinize any change in this area.

src/Io/MultipartParser.php: most-fixed (3 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

HTTP Request Smuggling: Outgoing headers were sent without validation, allowing CRLF injection and request smuggling; fixed by validating header names and values before writing.

HTTP Request Smuggling: Absolute-form request targets parsed with parse_url without validation could enable smuggling via proxy requests; fixed by validating absolute-form targets.

Path Traversal: New multipart parsing code uses tempnam and file_put_contents without safe filename handling, potentially allowing path traversal via uploaded filenames.