CVE-2023-29197CWE-436

Improper header name validation in guzzlehttp/psr7

Medium · published April 17, 2023

CVSS v3.1
5.3
EPSS
1%
Percentile
68.3
In the wild
Unconfirmed
What it is

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01216 · 68.3th percentile
Weakness
CWE-436 · Interpretation Conflict
Published
2023-04-17T21:08Z
EPSS history
Timeline
  • 17 APR 21:08Z
    Improper header name validation in guzzlehttp/psr7
    cvelistv5