{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-53933","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-06-11T15:46:12.317Z","datePublished":"2026-09-08T22:00:17.227Z","dateUpdated":"2026-09-09T13:15:37.549Z"},"containers":{"cna":{"title":"Maravel-Framework Vulnerable to Side-Channel Information Disclosure (Error Oracle) via Dynamic Route Fuzzing","problemTypes":[{"descriptions":[{"cweId":"CWE-203","lang":"en","description":"CWE-203: Observable Discrepancy","type":"CWE"}]}],"metrics":[{"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"}}],"references":[{"name":"https://web.archive.org/web/20260511235846/https://packagist.org/packages/macropay-solutions/maravel-framework","tags":["x_refsource_CONFIRM"],"url":"https://web.archive.org/web/20260511235846/https://packagist.org/packages/macropay-solutions/maravel-framework"},{"name":"https://web.archive.org/web/20250620110641/https://github.com/macropay-solutions/maravel/wiki","tags":["x_refsource_MISC"],"url":"https://web.archive.org/web/20250620110641/https://github.com/macropay-solutions/maravel/wiki"},{"name":"https://web.archive.org/web/20260316211934/https://macropay-solutions.github.io/maravel-docs","tags":["x_refsource_MISC"],"url":"https://web.archive.org/web/20260316211934/https://macropay-solutions.github.io/maravel-docs"}],"affected":[{"vendor":"macropay-solutions","product":"maravel-framework","versions":[{"version":"< 10.73.1","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-08T22:00:17.227Z"},"descriptions":[{"lang":"en","value":"Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders (e.g., `/api/v1/users/{id}`), the raw string placeholder key was mistakenly registered into the flat static route checklist. An attacker scanning endpoints could intentionally pass the literal template syntax (e.g., `GET /api/v1/users/{id}`) to force an unexpected match against the static map. Because the dynamic tree engine was bypassed, no arguments were captured. This forced modern PHP 8+ versions to throw a native `ArgumentCountError`, resulting in a 500 Internal Server Error instead of a uniform 404 Not Found. By tracking which fuzz patterns exploded into a 500 error, a malicious actor could programmatically profile and map out internal route parameter names and controller schemas. Version 10.73.1 contains a patch. As a workaround, mitigate this side-channel leak by implementing a defensive check in a global middleware. This will reject any literal brace patterns before they reach the router engine."}],"source":{"advisory":"GHSA-v2qf-qw42-8r3x","discovery":"UNKNOWN"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-09T13:14:42.531405Z","id":"CVE-2026-53933","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-09T13:15:37.549Z"}}]}}