CVE-2016-5385: HTTP Proxy header vulnerability

high Affects amphp/artax, bugsnag/bugsnag-laravel, drupal/core, guzzlehttp/guzzle, padraic/humbug_get_contents, drupal/drupal and 1 more. Feed 2026.10.29.1, updated 2026-10-28; published 2022-04-07; advisory modified 2023-11-08.

HTTP Proxy header vulnerability

Package: amphp/artax Composer
Affected versions: <1.0.4 or >=2.0.0 and <2.0.4 or >=2 and <2.0.4 or >0.7.1 and <1.0.4
Fixed in: 1.0.4, 2.0.4
Severity: high CVSS 8.1
Exploitation: not on CISA KEV · EPSS 50% (98.9th percentile)
Published: 2022-04-07
Source: osv.dev

References

HTTP Proxy header vulnerability

Package: bugsnag/bugsnag-laravel Composer
Affected versions: <2.0.2 or >=2 and <2.0.2
Fixed in: 2.0.2
Severity: high CVSS 8.1
Exploitation: not on CISA KEV · EPSS 50% (98.9th percentile)
Published: 2022-04-07
Source: osv.dev

References

HTTP Proxy header vulnerability

Package: drupal/core Composer
Affected versions: >=8.0 and <8.1.7 or >=8.0 and <8.1.0 or >=8.1.0 and <8.1.7
Fixed in: 8.1.7
Severity: high CVSS 8.1
Exploitation: not on CISA KEV · EPSS 50% (98.9th percentile)
Published: 2022-04-07
Source: osv.dev

References

HTTP Proxy header vulnerability

Package: guzzlehttp/guzzle Composer
Affected versions: >=6 and <6.2.1 or >=4.0.0-rc2 and <4.2.4 or >=5 and <5.3.1
Fixed in: 6.2.1, 4.2.4, 5.3.1
Severity: high CVSS 8.1
Exploitation: not on CISA KEV · EPSS 50% (98.9th percentile)
Published: 2022-04-07
Source: osv.dev

References

HTTP Proxy header vulnerability

Package: padraic/humbug_get_contents Composer
Affected versions: <1.1.2
Fixed in: 1.1.2
Severity: high CVSS 8.1
Exploitation: not on CISA KEV · EPSS 50% (98.9th percentile)
Published: 2022-04-07
Source: osv.dev

References

Drupal Core - Highly Critical - Injection - SA-CORE-2016-003

Package: drupal/drupal Composer
Affected versions: >=8.0 and <8.1.0 or >=8.1.0 and <8.1.7
Fixed in: 8.1.7
Severity: unknown
Exploitation: not on CISA KEV · EPSS 50% (98.9th percentile)
Source: friendsofphp

References

https://www.drupal.org/SA-CORE-2016-003

Environment Variable Injection

Package: typo3/cms Composer
Affected versions: >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.2.1
Fixed in: 8.2.1
Severity: unknown
Exploitation: not on CISA KEV · EPSS 50% (98.9th percentile)
Source: friendsofphp

References

https://typo3.org/security/advisory/typo3-core-sa-2016-019

CWE-601

NVD record amphp/artax advisories bugsnag/bugsnag-laravel advisories drupal/core advisories guzzlehttp/guzzle advisories padraic/humbug_get_contents advisories drupal/drupal advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

2017-05-09 unknown Cookie leakage to wrong origins and non-restricted cookie acceptance same package: amphp/artax
GHSA-gm98-g2wf-7c68 medium amphp/artax Cookie leakage to wrong origins and non-restricted cookie acceptance same package: amphp/artax
CVE-2018-7600 KEV critical A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and same package: drupal/core
CVE-2018-7602 KEV critical A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and same package: drupal/core
CVE-2019-6340 KEV high Some field types do not properly sanitize data from non-form sources. This can lead to arb same package: drupal/core
CVE-2026-9082 KEV critical Drupal core includes a database abstraction API to ensure that queries executed against th same package: drupal/core