CVE-2026-53933: CWE-203: Observable Discrepancy in macropay-solutions maravel-framework

CVE-2026-53933 affects the Maravel PHP framework before version 10.73.1. The vulnerability arises because dynamic route placeholders (e.g., /api/v1/users/{id}) are mistakenly registered as static keys. An attacker can send requests with literal placeholder syntax (e.g., GET /api/v1/users/{id}), causing the dynamic routing engine to be bypassed and triggering a native PHP 8+ ArgumentCountError. This results in a 500 Internal Server Error instead of the expected 404 Not Found. By detecting which inputs cause this error, an attacker can map internal route parameter names and controller structures, leaking sensitive routing information. The issue is patched in version 10.73.1. A temporary mitigation involves rejecting requests with literal brace patterns at a global middleware level.

The vulnerability allows an unauthenticated attacker to perform side-channel information disclosure by distinguishing between 500 Internal Server Errors and 404 Not Found responses. This enables profiling of internal route parameter names and controller schemas, potentially aiding further targeted attacks or reconnaissance. There is no indication of direct code execution or data modification from this vulnerability.

Version 10.73.1 of Maravel framework contains an official patch that fixes this vulnerability. Users should upgrade to this version to remediate the issue. As a temporary workaround, implement a global middleware that rejects any requests containing literal brace patterns (e.g., '{' or '}') before they reach the routing engine to prevent the side-channel leak.