mezzio-swoole Applications Using Diactoros Vulnerable to HTTP Host Header Attack
Impact
mezzio-swoole applications using Diactoros for their PSR-7 implementation, and which are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a Laminas\Diactoros\Uri instance associated with the incoming server request modified to reflect values from X-Forwarded-* headers. Such changes can potentially lead to XSS attacks (if a fully-qualified URL is used in links) and/or URL poisoning.
Patches
3.7.0, and 4.3.0 and later.
The patches present in these versions update the SwooleServerRequestFactory to filter out X-Forwarded-* headers when creating the initial request. They then by default pass that instance through a Laminas\Diactoros\ServerRequestFilter\FilterUsingXForwardedHeaders instance created from the trustReservedSubnet() constructor, ensuring that the request only honors the X-Forwarded-* headers for private reserved subnets.
Users can define the Laminas\Diactoros\ServerRequestFilter\FilterServerRequestInterface service if they wish to provide a different implementation, or configure the FilterUsingXForwardedHeaders instance differently. When defined, that instance will be used to filter the generated request instance.
Workarounds
Infrastructure or DevOps can place a trusted reverse proxy in front of the mezzio-swoole server.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in mezzio/mezzio-swoole
- Email us
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | mezzio/mezzio-swoole | < 3.7.0, >= 4.0.0, < 4.3.0 | 3.7.0, 4.3.0 |
References
- Weakness (CWE)
-- Platform
- Composer
- Package
mezzio/mezzio-swoole- Disclosed
- 29.07.2022
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-c8rp-cgf4-937w - CC BY 4.0
Vulnerability history: mezzio/mezzio-swoole
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.