CVE-2022-24775: high-severity vulnerability in guzzle psr7
Improper Input Validation in guzzlehttp/psr7
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The guzzlehttp/psr7 library doesn't properly validate HTTP headers, allowing attackers to insert newline characters and inject malicious header values. This can lead to HTTP header injection attacks that compromise request integrity.
The vulnerability exists in header parsing logic that fails to sanitize newline characters (CWE-20: Improper Input Validation). An attacker can inject arbitrary headers by embedding CRLF sequences into header values, potentially enabling header injection attacks. Patched in versions 1.8.4 and 2.1.1.
In the same product, most dangerous first.