Grahamcampbell

A denial of service issue exists in the `XmlRenderer` component, which generates depth-proportional indentation for every XML tag. An attacker can supply deeply nested Markdown or Abstract Syntax Tree (AST) structures to trigger quadratic memory consumption and output amplification, leading to the exhaustion of server resources.

The Footnote extension fails to deduplicate footnote definitions. This allows attackers to craft documents with duplicate footnote definitions and references to trigger quadratic output expansion, which consumes excessive memory and CPU to exhaust server resources, resulting in a denial of service.

A denial of service issue exists in the Attributes extension. The `findTargetAndDirection()` function in `AttributesListener` performs quadratic-time sibling list scanning. Unauthenticated attackers can exploit this by submitting approximately 32 KB of repeated attribute blocks, causing the parsing process to exceed 5 seconds and exhaust server resources.

A denial of service issue exists in the `UniqueSlugNormalizer::normalize()` function. The problem occurs when the function restarts its numeric-suffix search from 1 during every slug collision, leading to O(K^2) time complexity for K headings that collapse to the same base slug. This path is triggered when the `HeadingPermalinkExtension`, `FootnoteExtension`, or `TableOfContentsExtension` is registered. An unauthenticated attacker can provide a small Markdown document containing many headings that resolve to a single base slug, such as identical heading text, punctuation-only headings, or empty ATX headings, resulting in excessive CPU consumption.

The built-in cURL handlers (`CurlHandler` and `CurlMultiHandler`) fail to properly isolate `Proxy-Authorization` headers from origin servers. This occurs because the handlers place first-class request headers into the origin header list (`CURLOPT HTTPHEADER`) and only move them to the proxy-only list (`CURLOPT PROXYHEADER`) when an HTTP or HTTPS proxy is predicted. Consequently, proxy credentials may be sent to the origin server if the request is direct, bypassed via `no proxy` settings, sent through a SOCKS proxy, or redirected from a proxied hop to a non-proxied route. On systems with libcurl older than 7.37.0 or PHP cURL extensions lacking `CURLOPT PROXYHEADER`, `CURLOPT HEADEROPT`, and `CURLHEADER SEPARATE`, no proxy-only channel is available, leaving the header in the origin list for all routes. Additionally, the stream handler may expose credentials when combined with raw `stream context.http.proxy` overrides. An attacker controlling the origin server can capture these private credentials through access logs or tracing systems. This could allow the attacker to abuse access-controlled proxies or impersonate the proxy principal.

A denial of service issue exists in the `CookieJar` component. The system accepts an unlimited number of `Set-Cookie` header fields without size restrictions. A malicious server can return numerous large cookies, forcing the application to store excessive data in memory and generate oversized `Cookie` headers. This can lead to increased memory consumption, higher processing times, and request failures when the generated header exceeds the limits of a handler, HTTP implementation, proxy, or destination server. Additionally, a server on a sibling host can set parent-domain cookies that affect other sibling services using the same jar. This issue occurs when built-in cookie support is enabled and a jar is reused after receiving an attacker-controlled response.

An information disclosure issue exists in the `RedirectMiddleware` when the optional `allow redirects.referer` setting is enabled. During a same-scheme redirect (such as HTTPS to HTTPS), the middleware copies the URI fragment—the portion of the URI following the `#` symbol—into the generated `Referer` header. While URI fragments are typically handled locally by the client and not sent to the server in the initial request, this behavior allows a destination server controlling the redirect to read the fragment from the incoming header. This could lead to the disclosure of sensitive client data, such as access tokens, state values, or one-time login secrets. This issue affects both cURL and stream handlers. The `referer` setting is disabled by default.

The `CookieJar` component fails to preserve the host-only scope of response cookies that are set without a `Domain` attribute or with an empty one. Instead of marking these cookies as host-only, the software stores the request host in the `Domain` field. This behavior allows cookies intended exclusively for a parent host to be sent to child hosts if the same cookie jar is reused across different trust boundaries. An attacker controlling a child host could potentially intercept sensitive information, such as session identifiers and authorization tokens. This issue affects `FileCookieJar` and `SessionCookieJar` as well, as they persist the request host without recording the host-only state. The vulnerability is triggered when an application enables cookie support, reuses a built-in cookie jar, and makes requests to both a trusted parent host and a less-trusted child host.

The `Uri::assertValidHost()` function fails to reject URI host components that contain authority delimiters, embedded ports, or malformed IPv6 brackets. This discrepancy allows `Uri::getHost()` to return a value that differs from the URI authority used for routing or security decisions.

The `CookieJar` component fails to restrict cookies scoped to IP addresses or bare-numeric Domain values to the specific host that issued them. This occurs because the `matchesDomain()` function applies ordinary suffix matching to domains such as `192.168.0.1`, `[::1]`, or `1`. This behavior can lead to session fixation, cookie injection, or cross-host cookie disclosure.

In certain configurations, traffic intended to be protected by TLS on the hop to the proxy is transmitted in cleartext. This occurs when an application uses the built-in cURL handlers (`GuzzleHttpHandlerCurlHandler` and `GuzzleHttpHandlerCurlMultiHandler`) with an `https://` proxy while running on libcurl versions older than 7.50.2, which silently treat HTTPS proxies as plaintext HTTP proxies. Consequently, proxy authentication credentials—including the `Proxy-Authorization` header, proxy userinfo in the proxy URL, or `CURLOPT PROXYUSERPWD`—are sent without encryption. Additionally, the `CONNECT` target host and port for tunneled HTTPS requests are exposed, and for plain HTTP requests, both headers and bodies are exposed on the proxy leg.

The issue is related to improper header parsing, where an attacker could sneak in a newline into both the header names and values, potentially leading to denial of service vectors or application errors. This can occur when users create HTTP requests or responses using laminas/laminas-diactoros and provide a newline at the start or end of a header key or value, causing an invalid message.

The issue allows an attacker to sneak in a newline (` `) into both the header names and values. Although the specification states that `r r ` is used to terminate the header list, many servers also accept ` `. This could enable an attacker to craft invalid messages, potentially causing application errors or invalid HTTP requests being sent out with a PSR-18 HTTP client. The latter might present a denial of service vector if a remote service's web application firewall bans the application due to the receipt of malformed requests.

Guzzle, an extensible PHP HTTP client, has a issue where `Authorization` and `Cookie` headers on requests are sensitive information. In affected versions, when making a request that responds with a redirect to a URI with a different port, if the redirect is followed, the `Authorization` and `Cookie` headers should be removed from the request before proceeding. Previously, only changes in host or scheme would trigger this removal.

The issue concerns improper header parsing, allowing an attacker to sneak in a newline (` `) into both the header names and values. Many servers will also accept ` ` to terminate the header list, which is not in line with the specification that states `r r ` should be used. This could potentially lead to application errors or invalid HTTP requests being sent out, possibly causing a denial of service vector if a remote service's web application firewall bans the application due to the receipt of malformed requests.