{"id":"GHSA-8v5x-6vv5-jv4g","aliases":[],"title":"amphp/http Host Header Injection vulnerability","description":"amphp/http versions before 1.0.1 allows an attacker to supply invalid input in the Host header which may lead to various type of Host header injection attacks.","severity":"medium","score":null,"published":"2024-05-15T17:52:41.000Z","modified":"2024-11-29T05:51:32.132Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"amphp/http","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.0.1"}],"type":"ECOSYSTEM"}],"versions":["v1.0.0"],"fixed":["1.0.1"]}],"references":["https://github.com/amphp/http/pull/4","https://github.com/amphp/http/commit/16e465fa82555104d1cff98cb8e412295a380214","https://github.com/FriendsOfPHP/security-advisories/blob/master/amphp/http/2018-03-15.yaml","https://github.com/amphp/http","https://github.com/amphp/http/releases/tag/v1.0.1"],"sources":[{"name":"OSV","id":"GHSA-8v5x-6vv5-jv4g","modified":"2024-11-29T05:51:32.132276Z","url":"https://osv.dev/vulnerability/GHSA-8v5x-6vv5-jv4g"}],"assessments":[]}