GitHub Advisoryadvisory · Packagist

GHSA-8v5x-6vv5-jv4g amphp/http Host Header Injection vulnerability

MEDIUM Published 2024-05-15 Modified 2024-05-15 Official page ↗

Ecosystem: Packagist
Packages: amphp/http
Severity: Moderate
Reviewed: 2024-05-15

Affected packages

• Packagist amphp/http: < 1.0.1 → fixed in 1.0.1

Description

amphp/http versions before 1.0.1 allows an attacker to supply invalid input in the Host header which may lead to various type of Host header injection attacks.

References

https://github.com/amphp/http/pull/4 web
https://github.com/amphp/http/commit/16e465fa82555104d1cff98cb8e412295a380214 web
https://github.com/FriendsOfPHP/security-advisories/blob/master/amphp/http/2018-03-15.yaml web
https://github.com/amphp/http package
https://github.com/amphp/http/releases/tag/v1.0.1 web