{"id":"CVE-2022-36032","aliases":["GHSA-w3w9-vrf5-8mx8"],"url":"https://o3.security/vulnerability/CVE-2022-36032","summary":"ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent","details":"### Impact\n\nIn ReactPHP's HTTP server component versions below v1.7.0, when ReactPHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like `__Host-` and `__Secure-` confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-7070 and CVE-2020-8184 for more information. \n\n### Patches\n\n* https://github.com/reactphp/http/commit/663c9a3b77b71463fa7fcb76a6676ffd16979dd6 - Fixed in [reactphp/http `v1.7.0`](https://github.com/reactphp/http/releases/tag/v1.7.0)\n\n### Workarounds\n\nInfrastructure or DevOps can place a reverse proxy in front of the ReactPHP HTTP server to filter out any unexpected `Cookie` request headers.\n\n### References\n\n* CVE-2020-7070, https://bugs.php.net/bug.php?id=79699 and https://github.com/php/php-src/commit/6559fe912661ca5ce5f0eeeb591d928451428ed0\n* CVE-2020-8184, https://hackerone.com/reports/895727 and https://github.com/rack/rack/commit/1f5763de6a9fe515ff84992b343d63c88104654c\n* Originally introduced via https://github.com/reactphp/http/pull/175\n\n### Credits\n\n* Thanks to Marco Squarcina (TU Wien) for reporting this and working with us to coordinate this security advisory\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* [Join the discussion](https://github.com/orgs/reactphp/discussions/465)\n* Email us at support@reactphp.org\n","published":"2022-09-06T18:20:13Z","modified":"2026-10-28T02:30:39.751943886Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},"epss":{"score":0.01001,"percentile":0.61182,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"react/http","fixedVersion":"1.7.0"}],"fix":{"url":"https://github.com/reactphp/http/commit/663c9a3b77b71463fa7fcb76a6676ffd16979dd6","label":"reactphp/http@663c9a3"},"references":[{"type":"WEB","url":"https://github.com/reactphp/http/releases/tag/v1.7.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36032.json"},{"type":"ADVISORY","url":"https://github.com/reactphp/http/security/advisories/GHSA-w3w9-vrf5-8mx8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36032"},{"type":"FIX","url":"https://github.com/reactphp/http/commit/663c9a3b77b71463fa7fcb76a6676ffd16979dd6"},{"type":"FIX","url":"https://github.com/reactphp/http/pull/175"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/react/http/CVE-2022-36032.yaml"},{"type":"PACKAGE","url":"https://github.com/reactphp/http"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:39.751943886Z"}}