GHSA-wjfc-pgfp-pv9c
Improper Input Validation in nyholm/psr7
Impact
Improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n.
Patches
The issue is patched in 1.6.1.
Workarounds
There are no known workarounds.
References
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
What each source reports
GitHub Advisories Score used
Improper Input Validation in nyholm/psr7
Impact
Improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n.
Patches
The issue is patched in 1.6.1.
Workarounds
There are no known workarounds.
References
- Record
GHSA-wjfc-pgfp-pv9c- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-436
- Updated
- 2026-11-02
OSV
Improper Input Validation in nyholm/psr7
Impact
Improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n.
Patches
The issue is patched in 1.6.1.
Workarounds
There are no known workarounds.
References
- Record
GHSA-wjfc-pgfp-pv9c- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-436
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nyholm/psr7Packagist |
before 1.6.1 | 1.6.1 |
nyholm/psr7Packagist |
before 1.6.1, plus listed versions 0.1.00.2.00.2.10.2.20.2.3 Show 14 moreShow less0.3.01.0.01.0.11.1.01.2.01.2.11.3.01.3.11.3.21.4.01.4.11.5.01.5.11.6.0 |
1.6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-wjfc-pgfp-pv9c is a medium vulnerability (CVSS 5.3) in nyholm/psr7, published April 21, 2023. No source lists public exploit code. Fixed in nyholm/psr7 1.6.1.
References
github.com/Nyholm/psr7/security/advisories/GHSA-wjfc-pgfp-pv9c
nvd.nist.gov/vuln/detail/CVE-2023-29197