Vulnerability advisory

CVE-2023-29197

Improper header name validation in guzzlehttp/psr7

Published Apr 17, 2023Updated Oct 28, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/guzzle/psr7 ↗
All commits before e4490cabc77465aaee90b20cfc9a770f8c04be6b	`e4490cabc77465aaee90b20cfc9a770f8c04be6b`
1dc8d9cba3897165e16d12bb13d813afb1eb3fe7 to before 0454e12ef0cd597ccd2adb036f7bda4e7fface66	`0454e12ef0cd597ccd2adb036f7bda4e7fface66`
Also listed as affected (35) `2.4.4` `1.9.0` `2.4.3` `2.4.2` `2.4.1` `2.4.0` `1.8.5` `2.3.0` `2.2.2` `2.2.1` `2.2.0` `1.8.4` `2.1.0` `1.8.3` `2.0.0` `1.8.2` `1.8.1` `1.8.0` `1.7.0` `1.6.1` `1.6.0` `1.5.0` `1.5.2` `1.5.1` `1.4.2` `1.4.1` `1.4.0` `1.3.1` `1.3.0` `1.2.3` `1.2.2` `1.2.1` `1.2.0` `1.1.0` `1.0.0`

Description

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.

CVE-2023-29197

Affected versions

Repository

Description

References