-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| amphp/http-client | composer | >= 4.0.0, < 4.4.0 | 4.4.0 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from two interconnected issues:
FollowRedirects::createRedirectRequest, the original code used $request->setHeaders([]) to clear headers during cross-domain redirects. However, Message::setHeaders only operates on headers matching the provided keys (in this case, none), leaving existing headers intact.Message::setHeaders method itself is fundamentally flawed for this use case, as it merges headers rather than replacing them. This design caused the header retention. The patch replaced setHeaders([]) with explicit header removal via removeHeader, confirming the root cause lies in both the usage of setHeaders in FollowRedirects and the method's inherent behavior.