GHSA-f6p5-76fp-m248: URL Rewrite vulnerability in multiple zendframework components

high Affects zendframework/zend-diactoros, zendframework/zend-feed, zendframework/zend-http. Feed 2026.10.29.4, updated 2026-10-29; published 2022-04-28; advisory modified 2024-11-28.

URL Rewrite vulnerability in multiple zendframework components

Package: zendframework/zend-diactoros Composer
Affected versions: <1.8.4
Fixed in: 1.8.4
Severity: high
Exploitation: not on CISA KEV
Published: 2022-04-28
Source: osv.dev

References

URL Rewrite vulnerability in multiple zendframework components

Package: zendframework/zend-feed Composer
Affected versions: <2.10.3
Fixed in: 2.10.3
Severity: high
Exploitation: not on CISA KEV
Published: 2022-04-28
Source: osv.dev

References

URL Rewrite vulnerability in multiple zendframework components

Package: zendframework/zend-http Composer
Affected versions: <2.8.1
Fixed in: 2.8.1
Severity: high
Exploitation: not on CISA KEV
Published: 2022-04-28
Source: osv.dev

References

NVD record zendframework/zend-diactoros advisories zendframework/zend-feed advisories zendframework/zend-http advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden deps composer.lock

# or, without Composer
pipx install phpwarden   &&   phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2015-3257 medium zend-diactoros Cross-site Scripting (XSS) same package: zendframework/zend-diactoros
GHSA-fq4p-86hh-42v9 medium Zend-Diactoros URL Rewrite vulnerability same package: zendframework/zend-diactoros
ZF2018-01 unknown URL Rewrite vulnerability same package: zendframework/zend-diactoros
GHSA-jmmp-vh96-78rm high Zend-Feed URL Rewrite vulnerability same package: zendframework/zend-feed
CVE-2015-3154 medium Zenario CMS vulnerable to CRLF injection same package: zendframework/zend-http
GHSA-cg8w-5jrc-675g high Zend-HTTP URL Rewrite vulnerability same package: zendframework/zend-http