amphp/http · Security
amphp/http Host Header Injection vulnerability
- GHSA ID
- GHSA-8v5x-6vv5-jv4g
- Severity
- medium
- Published
- Updated
Description
amphp/http versions before 1.0.1 allows an attacker to supply invalid input in the Host header which may lead to various type of Host header injection attacks.
References
- https://github.com/amphp/http/pull/4 ↗
- https://github.com/amphp/http/commit/16e465fa82555104d1cff98cb8e412295a380214 ↗
- https://github.com/FriendsOfPHP/security-advisories/blob/master/amphp/http/2018-03-15.yaml ↗
- https://github.com/amphp/http/releases/tag/v1.0.1 ↗
- https://github.com/advisories/GHSA-8v5x-6vv5-jv4g ↗