Improper Input Validation in guzzlehttp/psr7
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 2.4%
exploitation probability
2.4%top 17% of all CVEs
observed exploitation
nono source reports it
In short
The guzzlehttp/psr7 library doesn't properly validate HTTP headers, allowing attackers to insert newline characters and inject malicious header values. This can lead to HTTP header injection attacks that compromise request integrity.
Technical detail
The vulnerability exists in header parsing logic that fails to sanitize newline characters (CWE-20: Improper Input Validation). An attacker can inject arbitrary headers by embedding CRLF sequences into header values, potentially enabling header injection attacks. Patched in versions 1.8.4 and 2.1.1.
Summary generated and translated by AI from the official description.
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
guzzle · psr7