CVE-2022-24775
Improper Input Validation in guzzlehttp/psr7
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper Input Validation in guzzlehttp/psr7
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
- Record
CVE-2022-24775- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2022-1513
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
- Record
EUVD-2022-1513- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-q7rv-6hp3-vh96
Improper Input Validation in guzzlehttp/psr7
Impact
Improper header parsing. An attacker could sneak in a carriage return character (\r) and pass untrusted values in both the header names and values.
Patches
The issue is patched in 1.8.4 and 2.1.1.
Workarounds
There are no known workarounds.
References
- Record
GHSA-q7rv-6hp3-vh96- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
- Record
CVE-2022-24775- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Improper Input Validation in guzzlehttp/psr7
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
- Record
CVE-2022-24775- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-24775
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
- Record
DEBIAN-CVE-2022-24775- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
Show 8 moreShow less
OSVGHSA-q7rv-6hp3-vh96
Improper Input Validation in guzzlehttp/psr7
Impact
Improper header parsing. An attacker could sneak in a carriage return character (\r) and pass untrusted values in both the header names and values.
Patches
The issue is patched in 1.8.4 and 2.1.1.
Workarounds
There are no known workarounds.
References
- Record
GHSA-q7rv-6hp3-vh96- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-24775
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
- Record
UBUNTU-CVE-2022-24775- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVBIT-drupal-2022-24775 No score
Improper Input Validation in guzzlehttp/psr7
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
- Record
BIT-drupal-2022-24775- Updated
- 2026-11-02
OSVCLSA-2026-1783991045 No score
TuxCare security update for guzzlehttp/psr7 (3 CVEs)
TuxCare rebuilt guzzlehttp/psr7 to address 3 CVEs. Fixed in 1.4.2-p1+tuxcare.
- Record
CLSA-2026-1783991045- Updated
- 2026-11-02
OSVCLSA-2026-1786527009 No score
TuxCare security update for guzzlehttp/psr7 (5 CVEs)
TuxCare rebuilt guzzlehttp/psr7 to address 5 CVEs. Fixed in 1.1.0-p1+tuxcare.
- Record
CLSA-2026-1786527009- Updated
- 2026-11-02
OSVCLSA-2026-1788257251 No score
TuxCare security update for league/oauth2-client (3 CVEs)
TuxCare rebuilt league/oauth2-client to address 3 CVEs. Fixed in 1.4.2-p1+tuxcare.
- Record
CLSA-2026-1788257251- Updated
- 2026-11-02
OSVDRUPAL-CORE-2022-006 No score
Drupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. Guzzle has released a security update which may affect some Drupal sites.
We are issuing this security advisory outside our regular Drupal security release window schedule since Guzzle has already published information about the vulnerability, and vulnerabilities might exist with core, contributed modules, or custom modules that use Guzzle for outgoing requests. Guzzle has rated this vulnerability as low-risk.
This advisory is not covered by Drupal Steward.
- Record
DRUPAL-CORE-2022-006- Updated
- 2026-11-02
OSVUSN-6670-1 No score
php-guzzlehttp-psr7 vulnerabilities
It was discovered that php-guzzlehttp-psr7 incorrectly parsed HTTP headers. A remote attacker could possibly use these issues to perform an HTTP header injection attack.
- Record
USN-6670-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
guzzlehttp/psr7Packagist |
before 1.8.4 | 1.8.4 |
guzzlehttp/psr7Packagist |
2.0.0 up to 2.1.1 | 2.1.1 |
drupalBitnami |
8.0.0 up to 9.2.16, 9.3.0 up to 9.3.9 | 9.2.169.3.9 |
guzzlehttp/psr7TuxCare:Packagist From an advisory covering 3 CVEs |
1.4.2 up to 1.4.2-p1+tuxcare | 1.4.2-p1+tuxcare |
guzzlehttp/psr7TuxCare:Packagist From an advisory covering 5 CVEs |
1.1.0 up to 1.1.0-p1+tuxcare | 1.1.0-p1+tuxcare |
php-guzzlehttp-psr7Debian:12 |
before 1.8.5-1 | 1.8.5-1 |
php-guzzlehttp-psr7Debian:13 |
before 1.8.5-1 | 1.8.5-1 |
php-guzzlehttp-psr7Debian:14 |
before 1.8.5-1 | 1.8.5-1 |
drupal/corePackagist |
8.0.0 up to 9.2.16, 9.3.0 up to 9.3.9, plus listed versions 8.0.18.0.28.0.38.0.48.0.5 Show 45 moreShow less8.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.88.3.08.3.0-alpha18.3.0-beta18.3.0-rc18.3.0-rc28.3.18.3.28.3.38.3.48.3.58.3.68.3.78.3.88.3.98.4.08.4.0-alpha1 |
9.2.169.3.9 |
guzzlehttp/psr7Packagist |
before 1.8.4, plus listed versions 1.0.01.1.01.2.01.2.11.2.2 Show 16 moreShow less1.2.31.3.01.3.11.4.01.4.11.4.21.5.01.5.11.5.21.6.01.6.11.7.01.8.01.8.11.8.21.8.3 |
1.8.4 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
guzzlehttp/psr7Packagist |
2.0.0 up to 2.1.1, plus listed versions 2.1.0 |
2.1.1 |
php-guzzlehttp-psr7Ubuntu:16.04:LTS |
All versions, plus listed versions 1.1.0-11.2.0-11.2.1-11.2.2-11.2.2-1build11.2.2-1ubuntu1 |
None known |
php-guzzlehttp-psr7Ubuntu:20.04:LTS |
before 1.4.2-0.1+deb10u2build0.20.04.1, plus listed versions 1.4.2-0.1 |
1.4.2-0.1+deb10u2build0.20.04.1 |
php-guzzlehttp-psr7Ubuntu:Pro:22.04:LTS |
before 1.8.3-1ubuntu0.1~esm1, plus listed versions 1.7.0-11.8.3-1 |
1.8.3-1ubuntu0.1~esm1 |
php-guzzlehttp-psr7Ubuntu:20.04:LTS From an advisory covering 2 CVEs |
before 1.4.2-0.1+deb10u2build0.20.04.1, plus listed versions 1.4.2-0.1 |
1.4.2-0.1+deb10u2build0.20.04.1 |
php-guzzlehttp-psr7Ubuntu:Pro:22.04:LTS From an advisory covering 2 CVEs |
before 1.8.3-1ubuntu0.1~esm1, plus listed versions 1.7.0-11.8.3-1 |
1.8.3-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-24775 is a high vulnerability (CVSS 7.5) in Guzzle Psr7, published March 21, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.48%, the 84th percentile. Fixed in guzzlehttp/psr7 1.8.4.
References
github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96
drupal.org/sa-core-2022-006
nvd.nist.gov/vuln/detail/CVE-2022-24775
rfc-editor.org/rfc/rfc7230
Show 9 moreShow less
security-tracker.debian.org/tracker/CVE-2022-24775
ubuntu.com/security/CVE-2022-24775
cve.org/CVERecord?id=CVE-2022-24775
Left out here: 185 versions. The JSON record has them.