CVE-2022-24775
Improper Input Validation in guzzlehttp/psr7
In short
The guzzlehttp/psr7 library doesn't properly validate HTTP headers, allowing attackers to insert newline characters and inject malicious header values. This can lead to HTTP header injection attacks that compromise request integrity.
Technical detail
The vulnerability exists in header parsing logic that fails to sanitize newline characters (CWE-20: Improper Input Validation). An attacker can inject arbitrary headers by embedding CRLF sequences into header values, potentially enabling header injection attacks. Patched in versions 1.8.4 and 2.1.1.
Summary generated and translated by AI from the official description.
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
guzzle · psr7Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →