amphp/http versions before 1.0.1 allows an attacker to supply invalid input in the Host header which may lead to various type of Host header injection attacks.

References

• amphp/http#4
• amphp/http@16e465f
• https://github.com/FriendsOfPHP/security-advisories/blob/master/amphp/http/2018-03-15.yaml
• https://github.com/amphp/http/releases/tag/v1.0.1