Vulnerability advisory

CVE-2022-24775

Improper Input Validation in guzzlehttp/psr7

Published Mar 21, 2022Updated Oct 28, 2026OSV record ↗

Also known as BIT-drupal-2022-24775DRUPAL-CORE-2022-006GHSA-q7rv-6hp3-vh96

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/drupal/drupal ↗
35c2f3ca5c935f3d8bde15932a712677c9bbd50f to before 7dedb70d1d4d58709908dc6c665c322ed47e4744	`7dedb70d1d4d58709908dc6c665c322ed47e4744`
698ee686c23de8c97d7e0601cf745b220d54f4e1 to before cce59c58baffd5b1f31102b480e0dd33c2d56f43	`cce59c58baffd5b1f31102b480e0dd33c2d56f43`
GIT github.com/guzzle/psr7 ↗
All commits before 902db15a551a4a415e732b622282e21ce1b508b4	`902db15a551a4a415e732b622282e21ce1b508b4`
1dc8d9cba3897165e16d12bb13d813afb1eb3fe7 to before 53491b6394cdcb66880063b82c0b16cf082711eb	`53491b6394cdcb66880063b82c0b16cf082711eb`
Also listed as affected (46) `9.2.15` `9.3.8` `9.2.14` `9.3.7` `9.3.4` `9.2.10` `9.3.2` `9.3.0` `9.2.8` `9.2.7` `9.2.5` `9.2.3` `9.2.1` `9.2.0` `9.2.0-rc1` `9.2.0-beta3` `9.2.0-beta2` `9.2.0-beta1` `9.2.0-alpha1` `9.0.0-alpha2` `9.0.0-alpha1` `8.1.0-beta1` `8.0.0` `2.1.0` `1.8.3` `2.0.0` `1.8.2` `1.8.1` `1.8.0` `1.7.0` `1.6.1` `1.6.0` `1.5.0` `1.5.2` `1.5.1` `1.4.2` `1.4.1` `1.4.0` `1.3.1` `1.3.0` `1.2.3` `1.2.2` `1.2.1` `1.2.0` `1.1.0` `1.0.0`

Description

guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.

CVE-2022-24775

Affected versions

Repository

Description

References