shadowdaoandClaude Opus 5.5
729098a8f9
PHP "RCE via OOM corruption" (GHSA-w8hw-w9fx-j79w) and the session upload-progress variant (GHSA-6wmf-4rv5-p3rp), interim until patched PHP is on every customer image. HAProxy (hap_listener.tpl, every frontend render, WAF on or off): deny 400 multipart/form-data with no Content-Length (HTTP/1.1 chunked, HTTP/2-3 streamed bodies) -- vector (a), the post_max_size bypass. Measured: Chrome 155 (h2 and h3) and Firefox 153 send content-length on form submits, FormData fetch and XHR; only a ReadableStream fetch body (duplex:'half') has none. Coraza (coraza-spoa/overrides.conf, 209610-209616): 209610 ARGS_NAMES/FILES_NAMES with more than 16 '[' 209611-613 part-header budget (4/part, deny 32 below zero) 209614-615 more than 64 empty-filename file parts 209616 multipart PHP_SESSION_UPLOAD_PROGRESS field Ids sit in the engine range 200000-209999 that WHP's break-glass rule (991000001) already removes, so no WHP release is needed for break-glass to lift them. Each flips the engine On for itself, like the day-one promotions, so they deny in every mode the sidecar runs in. Limitation: Coraza sees only the first 16 KB of a body. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2 lines
10 B
Plaintext
2 lines
10 B
Plaintext
2026.10.6
|