CVE-2026-53933: Maravel-Framework Vulnerable to Side-Channel Information Disclosure (Error Oracle) via Dynamic Route Fuzzing
Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders (e.g., /api/v1/users/{id}), the raw string placeholder key was mistakenly registered into the flat static route checklist. An attacker scanning endpoints could intentionally pass the literal template syntax (e.g., GET /api/v1/users/{id}) to force an unexpected match against the static map. Because the dynamic tree engine was bypassed, no arguments were captured. This forced modern PHP 8+ versions to throw a native ArgumentCountError, resulting in a 500 Internal Server Error instead of a uniform 404 Not Found. By tracking which fuzz patterns exploded into a 500 error, a malicious actor could programmatically profile and map out internal route parameter names and controller schemas. Version 10.73.1 contains a patch. As a workaround, mitigate this side-channel leak by implementing a defensive check in a global middleware. This will reject any literal brace patterns before they reach the router engine.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Maravelto a version that resolves this vulnerability.Fixed in 10.73.1 - Configuration
Implement a defensive middleware check that rejects any literal brace patterns (e.g., `/api/v1/users/{id}`) before the request is passed to the router engine to mitigate the side-channel leak.
Global middleware Defensive check to reject literal brace patterns = Reject requests containing literal template syntax such as `/api/v1/users/{id}` before they reach the router engine - Compensating control
Ensure the router does not register the raw placeholder key from dynamically compiled routes (e.g., when compiling `/api/v1/users/{id}`, do not mistakenly add `{id}`’s raw string placeholder key into the flat static route checklist), so that literal brace patterns cannot trigger the error-oracle behavior.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Maravel PHP Framework deployments using versions earlier than 10.73.1 are affected when they have routes compiled with dynamic placeholders. The observable behavior occurs on modern PHP 8+ versions, where the malformed route match triggers an ArgumentCountError and a 500 response.
What does an attacker need to do to exploit the information leak?
An attacker needs to send requests containing literal route-template brace syntax, such as GET /api/v1/users/{id}, and compare the responses. A 500 response instead of the normal 404 can reveal that a matching dynamic route placeholder exists and support route and controller-schema mapping.
Is there a mitigation if upgrading cannot happen immediately?
Implement a defensive check in global middleware that rejects requests containing literal brace patterns before they reach the router engine. This prevents the static-route checklist from matching the raw placeholder key and avoids the error-oracle behavior.
How can defenders identify possible probing activity?
Review request logs for paths containing literal curly braces, particularly strings resembling route templates such as /api/v1/users/{id}. Correlate those requests with 500 Internal Server Error responses or PHP ArgumentCountError events.