CVE-2023-26044 ReactPHP's HTTP server continues parsing unused multipart parts after reaching limits
Attackers can cause high CPU load and service delays by sending large HTTP bodies when specific middleware is configured with high limits.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-26044?
CVE-2023-26044 is a medium-severity denial of service vulnerability in reactphp http, published on 17 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. Previous versions of ReactPHP's HTTP server component contain a potential DoS vulnerability that can cause high CPU load when processing large HTTP request bodies. This vulnerability has little to no impact on the default configuration, but can be exploited when explicitly using the RequestBodyBufferMiddleware with very large settings. This might lead to consuming large amounts of CPU time for processing requests and significantly delay or slow down the processing of legitimate user requests. This issue has been addressed in release 1.9.0. Users are advised to upgrade. Users unable to upgrade may keep the request body limited using RequestBodyBufferMiddleware with a sensible value which should mitigate the issue. An infrastructure or DevOps workaround could be to place a reverse proxy in front of the ReactPHP HTTP server to filter out any excessive HTTP request bodies.
Weakness: CWE-400
Which versions are affected by CVE-2023-26044?
2 open source packages ship an affected version, including react/http. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
react/http Packagist | From 0.8.0 | 1.9.0 |
react/http Packagist | From 0.8.0 | 1.9.0 |
Products include Reactphp Http.
How do I fix CVE-2023-26044?
Upgrade react/http to 1.9.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-26044 being exploited?
There is no known exploitation of CVE-2023-26044 in the wild and no public exploit code.
Other vulnerabilities in reactphp http
Sources
Also known as GHSA-95x4-j7vc-h8mf, UBUNTU-CVE-2023-26044.