GHSA-f6p5-76fp-m248
URL Rewrite vulnerability in multiple zendframework components
zend-diactoros (and, by extension, Expressive), zend-http (and, by extension, Zend Framework MVC projects), and zend-feed (specifically, its PubSubHubbub sub-component) each contain a potential URL rewrite exploit. In each case, marshaling a request URI includes logic that introspects HTTP request headers that are specific to a given server-side URL rewrite mechanism.
When these headers are present on systems not running the specific URL rewriting mechanism, the logic would still trigger, allowing a malicious client or proxy to emulate the headers to request arbitrary content.
What each source reports
GitHub AdvisoriesNo score
URL Rewrite vulnerability in multiple zendframework components
zend-diactoros (and, by extension, Expressive), zend-http (and, by extension, Zend Framework MVC projects), and zend-feed (specifically, its PubSubHubbub sub-component) each contain a potential URL rewrite exploit. In each case, marshaling a request URI includes logic that introspects HTTP request headers that are specific to a given server-side URL rewrite mechanism.
When these headers are present on systems not running the specific URL rewriting mechanism, the logic would still trigger, allowing a malicious client or proxy to emulate the headers to request arbitrary content.
- Record
GHSA-f6p5-76fp-m248- Updated
- 2026-11-02
OSVNo score
URL Rewrite vulnerability in multiple zendframework components
zend-diactoros (and, by extension, Expressive), zend-http (and, by extension, Zend Framework MVC projects), and zend-feed (specifically, its PubSubHubbub sub-component) each contain a potential URL rewrite exploit. In each case, marshaling a request URI includes logic that introspects HTTP request headers that are specific to a given server-side URL rewrite mechanism.
When these headers are present on systems not running the specific URL rewriting mechanism, the logic would still trigger, allowing a malicious client or proxy to emulate the headers to request arbitrary content.
- Record
GHSA-f6p5-76fp-m248- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zendframework/zend-diactorosPackagist | before 1.8.4 | 1.8.4 |
zendframework/zend-feedPackagist | before 2.10.3 | 2.10.3 |
zendframework/zend-httpPackagist | before 2.8.1 | 2.8.1 |
zendframework/zend-diactorosPackagist | before 1.8.4, plus listed versions 1.0.01.0.11.0.21.0.31.0.4 Show 32 moreShow less1.0.51.1.01.1.11.1.21.1.31.1.41.2.01.2.11.3.01.3.11.3.101.3.111.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.5.01.6.01.6.11.7.01.7.11.7.21.8.01.8.11.8.21.8.3 | 1.8.4 |
zendframework/zend-feedPackagist | before 2.10.3, plus listed versions 2.0.32.0.42.0.52.0.62.0.7 Show 45 moreShow less2.0.82.1.02.1.12.1.22.1.32.1.42.1.52.1.62.10.02.10.12.10.22.2.02.2.0rc12.2.0rc22.2.0rc32.2.12.2.102.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.12.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0rc12.4.0rc22.4.0rc32.4.0rc42.4.0rc52.4.0rc62.4.0rc72.4.12.4.10 | 2.10.3 |
zendframework/zend-httpPackagist | before 2.8.1, plus listed versions 2.0.32.0.42.0.52.0.62.0.7 Show 45 moreShow less2.0.82.1.02.1.12.1.22.1.32.1.42.1.52.1.62.2.02.2.0rc12.2.0rc22.2.0rc32.2.12.2.102.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.12.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0rc12.4.0rc22.4.0rc32.4.0rc42.4.0rc52.4.0rc62.4.0rc72.4.12.4.102.4.112.4.122.4.13 | 2.8.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-f6p5-76fp-m248 is a vulnerability with no CVSS score yet in zendframework/zend-diactoros, published April 28, 2022. No source lists public exploit code. Fixed in zendframework/zend-diactoros 1.8.4.
References
github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-diactoros/ZF2018-01.yaml
Left out here: 37 versions. The JSON record has them.