CVE-2023-29530

    Dashboard / Vulnerabilities / CVE-2023-29530

    CVE-2023-29530

    Published: 24 Apr 2023Last Modified: 12 Aug 2026

    Summary: Laminas Diactoros vulnerable to HTTP Multiline Header Termination

    Details: Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users who create HTTP requests or responses using laminas/laminas-diactoros, when providing a newline at the start or end of a header key or value, can cause an invalid message. This can lead to denial of service vectors or application errors. The problem has been patched in following versions 2.18.1, 2.19.1, 2.20.1, 2.21.1, 2.22.1, 2.23.1, 2.24.1, and 2.25.1. As a workaround, validate HTTP header keys and/or values, and if using user-supplied values, filter them to strip off leading or trailing newline characters before calling `withHeader()`.

    References: https://lists.fedoraproject.org/archives/list/[email protected]/message/BPW54QK7ISDALPLP2CKODU4ZIVRYS336/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29530.json, https://github.com/advisories/GHSA-wxmh-65f7-jcvw, https://github.com/laminas/laminas-diactoros/security/advisories/GHSA-xv3h-4844-9h36, https://nvd.nist.gov/vuln/detail/CVE-2023-29530

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -e4490cabc77465aaee90b20cfc9a770f8c04be6b

    Affected versions

    2.19.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-29530 | CVE-DB