2026-10-21 13:11 UTC
Disabling any request body processing with #Vinyl_Cache to avoid the #php RCE is simple:
sub vcl_recv {
if (req.http.Content-Length || req.http.Transfer-Encoding) {
return (synth(403, "No req body"));
}
}
Replies (1)
-
@slink@fosstodon.org 2026-10-21 20:29
Thanks to a client, I looked at CVE-2026-109618 / CVE-2026-109619 a bit longer: The most relevant OOM vector seems to be request body processing, and, more specifically, multipart/form-data / rfc7578 processing. https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp