Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

zendframework/zend-http

              master @ ac4ffd0
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

Spoofing: 2 prior fixes. Scrutinize any change in this area.

src/Client/Adapter/Proxy.php: most-fixed (2 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

HTTP Response Splitting / Header Injection: CRLF injection in header values can lead to response splitting, cache poisoning, and XSS. Two separate fixes address this in the header parsing path, indicating a recurring weakness in header value validation.

Spoofing: IP spoofing via untrusted X-Forwarded-For headers can bypass access controls and audit logging. Two fixes required REMOTE_ADDR trust verification and proper XFF parsing, showing a history of insufficient proxy header validation.

Security Bypass: Using the proxy host instead of the target host in CONNECT requests can cause TLS handshake failures or security bypasses, potentially allowing MITM attacks.