Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

slimphp/slim-psr7

              main @ 76e7e3b
            

Fixes

CVEs

HIGH

Peak severity

14.3%

Coverage

Highlights

HTTP Response Splitting: 3 prior fixes. Scrutinize any change in this area.

src/Headers.php: most-fixed (5 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

HTTP Response Splitting: Inadequate regular expression anchoring allowed attackers to inject trailing newlines into HTTP headers, leading to header injection and response splitting vulnerabilities. This risk is tracked under CVE-2023-30536 and required appending the PCRE_DOLLAR_ENDONLY (D) modifier across multiple validation points.

Information Disclosure: When initializing HTTP response objects, an incorrect fallback behavior caused new Response instances to pull active request authorization headers from the global environment, inadvertently leaking sensitive credentials in outbound responses.

Auth Bypass: A case-sensitive header lookup mechanism during global Authorization header extraction allowed attackers to bypass authentication checks by supplying headers in non-standard casing.