GHSA-wxmh-65f7-jcvw CVE-2023-29197
Improper header name validation in guzzlehttp/psr7
- Severity
- 5.3 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 1.22%
- Chance of exploitation in the next 30 days. Higher than 68.59% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-436 Interpretation Conflict
- Fix
1.9.1- Upgrade guzzlehttp/psr7 to this version or later
Description
Impact
Improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n.
Patches
The issue is patched in 1.9.1 and 2.4.5.
Workarounds
There are no known workarounds.
References
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| guzzlehttp/psr7 | < 1.9.1 |
1.9.1 |
| guzzlehttp/psr7 | >= 2.0.0, < 2.4.5 |
2.4.5 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
guzzlehttp/psr7 Packagist → 1.9.1
- composer
composer require guzzlehttp/psr7:^1.9.1
Severity breakdown
CVSS 3.1 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Weakness
CWE-436: Interpretation Conflict
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
References
Advisories
Packages
Other links
- github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96
- github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw
- cve.mitre.org/cgi-bin/cvename.cgi
- github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/psr7/CVE-202…
- lists.debian.org/debian-lts-announce/2023/12/msg00028.html
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FJANW…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O35UN…
- rfc-editor.org/rfc/rfc7230
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-x5mq-jjr3-vmx6 Missing validation of header name and value in codeigniter4/framework | Medium | Linked by the source |
| GHSA-xv3h-4844-9h36 HTTP Multiline Header Termination | Medium | Linked by the source |
| DRUPAL-CORE-2022-006 Improper Input Validation in guzzlehttp/psr7 | Medium | Also affects guzzlehttp/psr7 |
| GHSA-5x38-2vff-x55p Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13 | High | Same weakness, CWE-436 |
| GHSA-9v7c-q64q-vv33 Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes | Medium | Same weakness, CWE-436 |
| GHSA-pq4g-8rxf-4g29 Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass | Medium | Same weakness, CWE-436 |
| GHSA-m665-v7pm-7grj zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE | Critical | Same weakness, CWE-436 |
| EEF-CVE-2026-115700 SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney | Not rated yet | Same weakness, CWE-436 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor