HighGHSA-xv3h-4844-9h36CVE-2023-29530

HTTP Multiline Header Termination

Published 24 Apr 2023 · Updated 4 Feb 2026

Affected packages

laminas/laminas-diactorosComposer
Affected
<2.18.1
Fixed in
2.18.1
Update to the fixed version for your release line, for example:composer require laminas/laminas-diactoros:^2.18.1
laminas/laminas-diactorosComposer
Affected
>=2.19.0 <2.19.1
Fixed in
2.19.1
Update to the fixed version for your release line, for example:composer require laminas/laminas-diactoros:^2.19.1
laminas/laminas-diactorosComposer
Affected
>=2.20.0 <2.20.1
Fixed in
2.20.1
Update to the fixed version for your release line, for example:composer require laminas/laminas-diactoros:^2.20.1
laminas/laminas-diactorosComposer
Affected
>=2.21.0 <2.21.1
Fixed in
2.21.1
Update to the fixed version for your release line, for example:composer require laminas/laminas-diactoros:^2.21.1
laminas/laminas-diactorosComposer
Affected
>=2.22.0 <2.22.1
Fixed in
2.22.1
Update to the fixed version for your release line, for example:composer require laminas/laminas-diactoros:^2.22.1
laminas/laminas-diactorosComposer
Affected
>=2.23.0 <2.23.1
Fixed in
2.23.1
Update to the fixed version for your release line, for example:composer require laminas/laminas-diactoros:^2.23.1
laminas/laminas-diactorosComposer
Affected
>=2.24.0 <2.24.2
Fixed in
2.24.2
Update to the fixed version for your release line, for example:composer require laminas/laminas-diactoros:^2.24.2
laminas/laminas-diactorosComposer
Affected
>=2.25.0 <2.25.2
Fixed in
2.25.2
Update to the fixed version for your release line, for example:composer require laminas/laminas-diactoros:^2.25.2

Details

Impact

Affected versions of Laminas Diactoros accepted a single line feed (LF / \n ) character at the end of a header name. When serializing such a header name containing a line-feed into the on-the-wire representation of a HTTP/1.x message, the resulting message would be syntactically invalid, due to the header line being terminated too early. An attacker that is able to control the header names that are passed to Laminas Diactoros would be able to intentionally craft invalid messages, possibly causing application errors or invalid HTTP requests being sent out with an PSR-18 HTTP client. The latter might present a denial of service vector if a remote service’s web application firewall bans the application due to the receipt of malformed requests.

Patches

The problem has been patched in the following versions:

  • 2.18.1
  • 2.19.1
  • 2.20.1
  • 2.21.1
  • 2.22.1
  • 2.23.1
  • 2.24.2
  • 2.25.2

Workarounds

Validate HTTP header keys and/or values, and if using user-supplied values, filter them to strip off leading or trailing newline characters before calling withHeader().

References

  • CVE-2023-29197
  • GHSA-wxmh-65f7-jcvw

Is GHSA-xv3h-4844-9h36 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected laminas/laminas-diactoros, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.