CVE-2022-36032

ReactPHP HTTP is a streaming HTTP client and server implementation for ReactPHP. In ReactPHP's HTTP server component versions starting with 0.7.0 and prior to 1.7.0, when ReactPHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like `__Host-` and `__Secure-` confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. This issue is fixed in ReactPHP HTTP version 1.7.0. As a workaround, Infrastructure or DevOps can place a reverse proxy in front of the ReactPHP HTTP server to filter out any unexpected `Cookie` request headers.

• CWE-20
• CWE-565

• https://github.com/reactphp/http/commit/663c9a3b77b71463fa7fcb76a6676ffd16979dd6Patch, Third Party Advisory
• https://github.com/reactphp/http/pull/175Issue Tracking, Patch, Third Party Advisory
• https://github.com/reactphp/http/releases/tag/v1.7.0Release Notes, Third Party Advisory
• https://github.com/reactphp/http/security/advisories/GHSA-w3w9-vrf5-8mx8Issue Tracking, Patch, Third Party Advisory
• https://github.com/reactphp/http/commit/663c9a3b77b71463fa7fcb76a6676ffd16979dd6Patch, Third Party Advisory
• https://github.com/reactphp/http/pull/175Issue Tracking, Patch, Third Party Advisory
• https://github.com/reactphp/http/releases/tag/v1.7.0Release Notes, Third Party Advisory
• https://github.com/reactphp/http/security/advisories/GHSA-w3w9-vrf5-8mx8Issue Tracking, Patch, Third Party Advisory

Published

Sep 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-36027TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-36028Greenlight is an end-user interface for BigBlueButton server…6.1
• CVE-2022-36029Greenlight is an end-user interface for BigBlueButton server…6.1
• CVE-2022-3603The Export customers list csv for WooCommerce, WordPress use…9.8
• CVE-2022-36030Project-nexus is a general-purpose blog website framework. A…9.8
• CVE-2022-36031Directus is a free and open-source data platform for headles…6.5
• CVE-2022-36033jsoup is a Java HTML parser, built for HTML editing, cleanin…6.1
• CVE-2022-36034nitrado.js is a type safe wrapper for the Nitrado API. Possi…7.5
• CVE-2022-36035Flux is a tool for keeping Kubernetes clusters in sync with …7.8
• CVE-2022-36036mdx-mermaid provides plug and play access to Mermaid in MDX.…7.8
• CVE-2022-36037kirby is a content management system (CMS) that adapts to ma…5.4
• CVE-2022-36038CircuitVerse is an open-source platform which allows users t…7.8