Improper header name validation in guzzlehttp/psr7
CVE-2023-29197
5.3MEDIUM
What is CVE-2023-29197?
The GuzzleHTTP PSR-7 library, a popular PHP HTTP message library, exhibits an improper header parsing vulnerability that allows an attacker to insert newline characters into header names and values. The vulnerability arises from the library’s handling of HTTP headers, where even though the HTTP specification requires headers to terminate with
, many servers erroneously accept
as a valid termination. This flaw is a follow-up to a previous security issue that went unresolved, emphasizing the importance of upgrading to the patched versions, 1.9.1 and 2.4.5, to mitigate potential exploitation.
Affected Version(s)
psr7 < 1.9.1 < 1.9.1
psr7 >= 2.0.0, < 2.4.5 < 2.0.0, 2.4.5