Security Advisory

ZF2013-04: Potential Remote Address Spoofing Vector in Zend\Http\PhpEnvironment\RemoteAddress

The Zend\Http\PhpEnvironment\RemoteAddress class provides features around detecting the internet protocol (IP) address for an incoming proxied request via the X-Forwarded-For header, taking into account a provided list of trusted proxy server IPs. Prior to 2.2.5, the class was not taking into account whether or not the IP address contained in PHP's $_SERVER['REMOTE_ADDR'] was in the trusted proxy server list.

The IETF draft specification indicates that if $_SERVER['REMOTE_ADDR'] is not a trusted proxy, it must be considered the originating IP address, and the value of X-Forwarded-For must be disregarded.

Action Taken

We have made the following change to the Zend\Http\PhpEnvironment\RemoteAddress class:


You are only affected by this as an issue if you directly consume one of the following in your code:

If you do, we recommend immediately upgrading to version 2.2.5.

Other Information


The Zend Framework team thanks the following for identifying the issues and working with us to help protect its users:

Reporting Potential Security Issues

If you have encountered a potential security vulnerability in Zend Framework, please report it to us at We will work with you to verify the vulnerability and patch it.

When reporting issues, please provide the following information:

We request that you contact us via the email address above and give the project contributors a chance to resolve the vulnerability and issue a new release prior to any public exposure; this helps protect Zend Framework users and provides them with a chance to upgrade and/or update in order to protect their applications.

For sensitive email communications, please use our PGP key.


Zend Framework takes security seriously. If we verify a reported security vulnerability, our policy is:

Released Thu, 31 October 2013 14:00:00 -0500.

back to advisories