Improper header validation in httpsoft/http-message
Priority LOW 38CWE-436Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
### Impact Improper header parsing. An attacker could sneak in a newline (`\n`) into both the header names and values. While the specification states that `\r\n\r\n` is used to terminate the header list, many servers in the wild will also accept `\n\n`. ### Patches The issue is patched in 1.0.12. ### Workarounds There are no known workarounds. ### References * https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4
Why it matters now
Fix Fixed httpsoft/http-message (Packagist): 1.0.12
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | httpsoft/http-message (Packagist) | before 1.0.12 | 1.0.12 | Patch available | GHSA-9jxr-mwpp-w643 |
- httpsoft/http-message (Packagist) Vendor— Affected before 1.0.12 Fixed in 1.0.12 Patch available GHSA-9jxr-mwpp-w643
Remediation
- Fix · GHSA-9jxr-mwpp-w643 httpsoft/http-message (Packagist) Fixed in 1.0.12 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-9jxr-mwpp-w643
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences