Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

laminas/laminas-http

              2.24.x @ 9462fc8
            

Fixes

CVEs

CRITICAL

Peak severity

40.0%

Coverage

Highlights

Broken Cryptography: 2 prior fixes. Scrutinize any change in this area.

src/Client/Adapter/Proxy.php: most-fixed (2 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Object Injection: A deserialization vulnerability (CVE-2021-3007) in the Stream response destructor allowed remote code execution via arbitrary file deletion when untrusted serialized data was processed. Mitigation requires strict type and existence checks on the stream name before calling unlink.

Insecure TLS Validation: The Proxy adapter failed to configure 'ssl.peer_name', bypassing SNI and TLS certificate verification when routing traffic through an HTTP proxy. Transport security must explicitly enforce peer verification on proxied streams.

Broken Cryptography: Insecure SSL/TLS protocol negotiation and fallback mechanisms allowed connections to downgrade to weak protocols. Mitigation requires routing proxy crypto negotiation through a centralized, secure transport helper rather than local negotiation.