zbateson/mail-mime-parser 4.0.9

on PHP Packagist

What's Changed

• fix invalid weekday handling in date header parsing by @Commandserver in #274
• Strip control characters from the parsed protocol parameter used for a signature part's Content-Type
• Record a parse error for header lines containing a CR not followed by LF
• Match RFC 2047 encoded words in linear time regardless of charset length

Security

This release fixes two reported vulnerabilities:

• GHSA-AAAA -- header injection through the parsed protocol parameter in setAsMultipartSigned(), not covered by the fix for GHSA-gmgm-r6fh-fq6g reported by @4n86rakam1
• GHSA-BBBB -- CPU exhaustion from regex backtracking when decoding encoded words in long header parameters reported by aweiaaaaa (account deleted)

Upgrading is recommended.

New Contributors

• @Commandserver made their first contribution in #274

Full Changelog: 4.0.8...4.0.9