Improper header name validation in guzzlehttp/psr7
Priority LOW 35CWE-436Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.
Why it matters now
EPSS 0.01216 68th percentileScored 2026-11-07
Fix Fixed psr7 (guzzle): 1.9.1, 2.4.5guzzlehttp/psr7 (Packagist): 1.9.1, 2.4.5
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| guzzle | psr7 | before 1.9.1; 2.0.0 to before 2.4.5 | 1.9.1, 2.4.5 | Patch available | CNA |
| — | guzzlehttp/psr7 (Packagist) | before 1.9.1 | 1.9.1 | Patch available | GHSA-wxmh-65f7-jcvw |
| — | guzzlehttp/psr7 (Packagist) | 2.0.0 to before 2.4.5 | 2.4.5 | Patch available | GHSA-wxmh-65f7-jcvw |
- psr7 Vendorguzzle Affected before 1.9.1; 2.0.0 to before 2.4.5 Fixed in 1.9.1, 2.4.5 Patch available CNA
- guzzlehttp/psr7 (Packagist) Vendor— Affected before 1.9.1 Fixed in 1.9.1 Patch available GHSA-wxmh-65f7-jcvw
- guzzlehttp/psr7 (Packagist) Vendor— Affected 2.0.0 to before 2.4.5 Fixed in 2.4.5 Patch available GHSA-wxmh-65f7-jcvw
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:guzzlephp:psr-7:*:*:*:*:*:*:*:* | before 1.9.1; 2.0.0 to before 2.4.5 | Vulnerable | guzzle |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
- cpe:2.3:a:guzzlephp:psr-7:*:*:*:*:*:*:*:* Versions before 1.9.1; 2.0.0 to before 2.4.5 Vulnerable ·guzzle
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA psr7 (guzzle) Fixed in 1.9.1, 2.4.5
- Fix · GHSA-wxmh-65f7-jcvw guzzlehttp/psr7 (Packagist) Fixed in 1.9.1 Advisory →
- Fix · GHSA-wxmh-65f7-jcvw guzzlehttp/psr7 (Packagist) Fixed in 2.4.5 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2023-29197
- 2026-10-03 Alias added: GHSA-wxmh-65f7-jcvw
References
Advisory 4
- https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw
- https://lists.fedoraproject.org/archives/list/[email protected]/message/O35UN4IK6VS2LXSRWUDFWY7NI73RKY2U/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/FJANWDXJZE5BGLN4MQ4FEHV5LJ6CMKQF/
- https://nvd.nist.gov/vuln/detail/CVE-2023-29197
Other 8
- https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-24775
- https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4
- https://lists.debian.org/debian-lts-announce/2023/12/msg00028.html
- https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/psr7/CVE-2023-29197.yaml
- https://github.com/guzzle/psr7
- https://lists.fedoraproject.org/archives/list/[email protected]/message/FJANWDXJZE5BGLN4MQ4FEHV5LJ6CMKQF
- https://lists.fedoraproject.org/archives/list/[email protected]/message/O35UN4IK6VS2LXSRWUDFWY7NI73RKY2U
More guzzle Psr-7 vulnerabilities
- TI-2022-08589 Improper Input Validation in guzzlehttp/psr7 CVSS 3.1HIGH 7.5
- TI-2023-13898 Laminas Diactoros vulnerable to HTTP Multiline Header Termination CVSS 3.1HIGH 7.5
- TI-2026-42696 guzzlehttp/psr7: Host Confusion via Weak URI Host Validation CVSS 3.1MEDIUM 6.5
- TI-2026-36415 guzzlehttp/psr7 has CRLF Injection via URI Host Component CVSS 3.1MEDIUM 5.3
- TI-2026-36252 guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation CVSS 3.1MEDIUM 5.3
- TI-2026-40255 guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization CVSS 3.1MEDIUM 4.8
Sources
- CVE-2023-29197 · CVE Program
- CVE-2023-29197 · NVD
- FIRST EPSS
- GHSA-wxmh-65f7-jcvw · GitHub Advisory Database · CC BY 4.0
- CVE-2023-29197 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences