GHSA-8v5x-6vv5-jv4g: 
PHP vulnerability analysis and mitigation

The amphp/http package versions before 1.0.1 contained a Host Header Injection vulnerability (GHSA-8v5x-6vv5-jv4g). The vulnerability was discovered and patched on March 15, 2018, affecting the PHP package amphp/http. This security issue allowed attackers to supply invalid input in the Host header which could lead to various types of Host header injection attacks (GitHub Advisory).

The vulnerability stemmed from incorrect header injection checks in the package's code. The issue was related to how the package handled header validation, particularly in cases where malicious input contained line feeds (\n), carriage returns (\r), or combinations of both in header names and values. The fix involved improving the header validation logic to properly detect and prevent these injection attempts (GitHub Commit).

The vulnerability could allow attackers to perform various types of Host header injection attacks. This type of vulnerability could potentially lead to security issues such as request smuggling, cache poisoning, or other HTTP-based attacks (GitHub Advisory).

The vulnerability was rated as Moderate severity. It required an attacker to be able to supply malicious input through the Host header of HTTP requests (GitHub Advisory).

The vulnerability was fixed in version 1.0.1 of the amphp/http package. Users should upgrade to version 1.0.1 or later to receive the security fix (GitHub Release).