CVE-2023-29197
Improper header name validation in guzzlehttp/psr7
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper header name validation in guzzlehttp/psr7
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.
- Record
CVE-2023-29197- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-436
- Updated
- 2026-11-02
EUVDEUVD-2023-1416
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.
- Record
EUVD-2023-1416- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wxmh-65f7-jcvw
Improper header name validation in guzzlehttp/psr7
Impact
Improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n.
Patches
The issue is patched in 1.9.1 and 2.4.5.
Workarounds
There are no known workarounds.
References
- Record
GHSA-wxmh-65f7-jcvw- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-436
- Updated
- 2026-11-02
NVD
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.
- Record
CVE-2023-29197- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-436
- Updated
- 2026-11-02
OSV
Improper header name validation in guzzlehttp/psr7
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.
- Record
CVE-2023-29197- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-436
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-29197
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.
- Record
DEBIAN-CVE-2023-29197- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-wxmh-65f7-jcvw
Improper header name validation in guzzlehttp/psr7
Impact
Improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n.
Patches
The issue is patched in 1.9.1 and 2.4.5.
Workarounds
There are no known workarounds.
References
- Record
GHSA-wxmh-65f7-jcvw- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-436
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-29197
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.
- Record
UBUNTU-CVE-2023-29197- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1788333194 No score
TuxCare security update for guzzlehttp/psr7 (1 CVE)
TuxCare rebuilt guzzlehttp/psr7 to address 1 CVE. Fixed in 1.1.0-p2+tuxcare.
- Record
CLSA-2026-1788333194- Updated
- 2026-11-02
OSVMGASA-2023-0241 No score
Updated mediawiki packages fix security vulnerability
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n (CVE-2023-29197).
Manualthumb bypasses badFile lookup (CVE-2023-36674).
XSS in BlockLogFormatter due to unsafe message use (CVE-2023-36675).
- Record
MGASA-2023-0241- Updated
- 2026-11-02
OSVUSN-6670-1 No score
php-guzzlehttp-psr7 vulnerabilities
It was discovered that php-guzzlehttp-psr7 incorrectly parsed HTTP headers. A remote attacker could possibly use these issues to perform an HTTP header injection attack.
- Record
USN-6670-1- Updated
- 2026-11-02
OSVUSN-6671-1 No score
php-nyholm-psr7 vulnerability
It was discovered that php-nyholm-psr7 incorrectly parsed HTTP headers. A remote attacker could possibly use this issue to perform an HTTP header injection attack.
- Record
USN-6671-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
guzzlehttp/psr7Packagist |
before 1.9.1 | 1.9.1 |
guzzlehttp/psr7Packagist |
2.0.0 up to 2.4.5 | 2.4.5 |
guzzlehttp/psr7TuxCare:Packagist |
1.1.0 up to 1.1.0-p2+tuxcare, plus listed versions 1.1.0-p1+tuxcare |
1.1.0-p2+tuxcare |
php-guzzlehttp-psr7Debian:12 |
before 2.4.5-1 | 2.4.5-1 |
php-guzzlehttp-psr7Debian:13 |
before 2.4.5-1 | 2.4.5-1 |
php-guzzlehttp-psr7Debian:14 |
before 2.4.5-1 | 2.4.5-1 |
php-nyholm-psr7Debian:12 |
before 1.5.1-2 | 1.5.1-2 |
php-nyholm-psr7Debian:13 |
before 1.5.1-2 | 1.5.1-2 |
php-nyholm-psr7Debian:14 |
before 1.5.1-2 | 1.5.1-2 |
php-guzzlehttp-psr7Debian:10 |
before 1.4.2-0.1+deb10u2, plus listed versions 1.4.2-0.11.4.2-0.1+deb10u1 |
1.4.2-0.1+deb10u2 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
guzzlehttp/psr7Packagist |
before 1.9.1, plus listed versions 1.0.01.1.01.2.01.2.11.2.2 Show 19 moreShow less1.2.31.3.01.3.11.4.01.4.11.4.21.5.01.5.11.5.21.6.01.6.11.7.01.8.01.8.11.8.21.8.31.8.41.8.51.9.0 |
1.9.1 |
guzzlehttp/psr7Packagist |
2.0.0 up to 2.4.5, plus listed versions 2.1.02.1.12.1.22.2.02.2.1 Show 7 moreShow less2.2.22.3.02.4.02.4.12.4.22.4.32.4.4 |
2.4.5 |
mediawikiMageia:8 From an advisory covering 3 CVEs |
before 1.35.11-1.mga8 | 1.35.11-1.mga8 |
php-guzzlehttp-psr7Ubuntu:16.04:LTS |
All versions, plus listed versions 1.1.0-11.2.0-11.2.1-11.2.2-11.2.2-1build11.2.2-1ubuntu1 |
None known |
php-guzzlehttp-psr7Ubuntu:20.04:LTS |
before 1.4.2-0.1+deb10u2build0.20.04.1, plus listed versions 1.4.2-0.1 |
1.4.2-0.1+deb10u2build0.20.04.1 |
php-nyholm-psr7Ubuntu:20.04:LTS |
All versions, plus listed versions 1.1.0-21.2.1-2 |
None known |
php-guzzlehttp-psr7Ubuntu:Pro:22.04:LTS |
before 1.8.3-1ubuntu0.1~esm1, plus listed versions 1.7.0-11.8.3-1 |
1.8.3-1ubuntu0.1~esm1 |
php-nyholm-psr7Ubuntu:Pro:22.04:LTS |
before 1.5.0-1ubuntu0.1~esm1, plus listed versions 1.3.2-21.5.0-1 |
1.5.0-1ubuntu0.1~esm1 |
php-guzzlehttp-psr7Ubuntu:20.04:LTS From an advisory covering 2 CVEs |
before 1.4.2-0.1+deb10u2build0.20.04.1, plus listed versions 1.4.2-0.1 |
1.4.2-0.1+deb10u2build0.20.04.1 |
php-guzzlehttp-psr7Ubuntu:Pro:22.04:LTS From an advisory covering 2 CVEs |
before 1.8.3-1ubuntu0.1~esm1, plus listed versions 1.7.0-11.8.3-1 |
1.8.3-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-29197 is a medium vulnerability (CVSS 5.3) in Guzzle Psr7, published April 17, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.22%, the 68th percentile. Fixed in guzzlehttp/psr7 1.9.1.
References
github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw
cve.mitre.org/cgi-bin/cvename.cgi?name=2022-24775
rfc-editor.org/rfc/rfc7230
lists.fedoraproject.org/archives/list/[email protected]/message/O35UN4IK6VS2LXSRWUDFWY7NI73RKY2U
Show 18 moreShow less
lists.debian.org/debian-lts-announce/2023/12/msg00028.html
nvd.nist.gov/vuln/detail/CVE-2023-29197
security-tracker.debian.org/tracker/CVE-2023-29197
advisories.mageia.org/MGASA-2023-0241.html
bugs.mageia.org/show_bug.cgi?id=32083
lists.wikimedia.org/hyperkitty/list/[email protected]/thread/HVT3U3XYY35PSCIQPHMY4VQNF3Q6MHUO
ubuntu.com/security/CVE-2023-29197
cve.org/CVERecord?id=CVE-2023-29197