R3Verii

The `HeaderUtils::split()` function parses header values using a pattern where a token alternative matches whitespace followed by a lookbehind. When a sequence of whitespace is placed before a separator, the engine attempts to divide the whitespace among iterations in exponentially many ways. This occurs within `HeaderBag` when processing the `Cache-Control` header during Request construction, making any application handling HTTP requests reachable without authentication. A request with a specifically crafted header can cause high CPU consumption; for instance, 17 spaces in an 8 KB header can cost nearly one second of CPU time. When 18 or more spaces are used, `preg match all()` reaches the `pcre.backtrack limit`, causing `split()` to return an empty array and silently drop all header directives.

A Server-Side Request Forgery (SSRF) issue exists in MailerPress. This allows for Server Side Request Forgery. The vulnerability affects the `mailerpress` component.

listmonk, a standalone newsletter and mailing list manager, is susceptible to a chain of vulnerabilities involving Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS). Specifically, the `nonce` value included in HTTP requests, alongside the session cookie `session`, is not validated by the backend. Removing this `nonce` allows requests to be processed, which, when combined with other vulnerabilities, can lead to critical issues such as improper admin account creation. The lack of a `SameSite` cookie policy further exacerbates the risk, potentially enabling exploitation through malicious websites. Exploitation involves chaining CSRF and XSS to execute arbitrary code in the victim's browser, ultimately allowing an attacker to create new administrative accounts.