Improper Input Validation in nyholm/psr7
Priority LOW 38CWE-436Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
### Impact Improper header parsing. An attacker could sneak in a newline (`\n`) into both the header names and values. While the specification states that `\r\n\r\n` is used to terminate the header list, many servers in the wild will also accept `\n\n`. ### Patches The issue is patched in 1.6.1. ### Workarounds There are no known workarounds. ### References * https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4
Why it matters now
Fix Fixed nyholm/psr7 (Packagist): 1.6.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | nyholm/psr7 (Packagist) | before 1.6.1 | 1.6.1 | Patch available | GHSA-wjfc-pgfp-pv9c |
- nyholm/psr7 (Packagist) Vendor— Affected before 1.6.1 Fixed in 1.6.1 Patch available GHSA-wjfc-pgfp-pv9c
Remediation
- Fix · GHSA-wjfc-pgfp-pv9c nyholm/psr7 (Packagist) Fixed in 1.6.1 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-wjfc-pgfp-pv9c
References
Other 5
- https://github.com/Nyholm/psr7/security/advisories/GHSA-wjfc-pgfp-pv9c
- https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96
- https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw
- https://github.com/FriendsOfPHP/security-advisories/blob/master/nyholm/psr7/2023-04-17.yaml
- https://github.com/Nyholm/psr7
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences