.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

Vulnerability advisory

GHSA-q7rv-6hp3-vh96

Improper Input Validation in guzzlehttp/psr7

Published Mar 25, 2022Updated Feb 4, 2026OSV record ↗

Also known as BIT-drupal-2022-24775CVE-2022-24775DRUPAL-CORE-2022-006

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected versions

guzzlehttp/psr7 Packagist

All guzzlehttp/psr7 advisories →

Affected	Fixed in
All versions before 1.8.4	`1.8.4`Advisories →
Also listed as affected (21) `1.0.0` `1.1.0` `1.2.0` `1.2.1` `1.2.2` `1.2.3` `1.3.0` `1.3.1` `1.4.0` `1.4.1` `1.4.2` `1.5.0` `1.5.1` `1.5.2` `1.6.0` `1.6.1` `1.7.0` `1.8.0` `1.8.1` `1.8.2` `1.8.3`
`2.0.0` to before 2.1.1	`2.1.1`Advisories →
Also listed as affected (2) `2.0.0` `2.1.0`

Description

Impact

Improper header parsing. An attacker could sneak in a carriage return character (\r) and pass untrusted values in both the header names and values.

Patches

The issue is patched in 1.8.4 and 2.1.1.

Workarounds

There are no known workarounds.

References

https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4

References