{"id":"CVE-2023-29197","aliases":["CLSA-2026-1788333194","DEBIAN-CVE-2023-29197","DLA-3705-1","EUVD-2023-1416","GHSA-wxmh-65f7-jcvw","MGASA-2023-0241","UBUNTU-CVE-2023-29197","USN-6670-1","USN-6671-1"],"status":"published","title":"Improper header name validation in guzzlehttp/psr7","description":"guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\\n) into both the header names and values. While the specification states that \\r\\n\\r\\n is used to terminate the header list, many servers in the wild will also accept \\n\\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01216,"percentile":0.68829,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-436"],"published":"2023-04-17T21:08:46Z","modified":"2026-10-28T02:30:38Z","fixes":[{"ecosystem":"Packagist","package":"guzzlehttp/psr7","fixed_in":["1.9.1","2.4.5"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Packagist","package":"guzzlehttp/psr7","fixed_in":["1.1.0-p2+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"php-guzzlehttp-psr7","fixed_in":["2.4.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"php-guzzlehttp-psr7","fixed_in":["2.4.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"php-guzzlehttp-psr7","fixed_in":["2.4.5-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"php-nyholm-psr7","fixed_in":["1.5.1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"php-nyholm-psr7","fixed_in":["1.5.1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"php-nyholm-psr7","fixed_in":["1.5.1-2"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"php-guzzlehttp-psr7","fixed_in":["1.4.2-0.1+deb10u2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"php-guzzlehttp-psr7","fixed_in":["1.4.2-0.1+deb10u2build0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"php-guzzlehttp-psr7","fixed_in":["1.8.3-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"php-nyholm-psr7","fixed_in":["1.5.0-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"guzzlehttp/psr7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"guzzlehttp/psr7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.4.5"}]}]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"guzzlehttp/psr7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.0-p2+tuxcare"}]}],"versions":["1.1.0","1.1.0-p1+tuxcare"]},{"source":"osv","ecosystem":"Debian:12","package":"php-guzzlehttp-psr7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"php-guzzlehttp-psr7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"php-guzzlehttp-psr7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"php-nyholm-psr7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"php-nyholm-psr7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"php-nyholm-psr7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-2"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"php-guzzlehttp-psr7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-0.1+deb10u2"}]}],"versions":["1.4.2-0.1","1.4.2-0.1+deb10u1"]},{"source":"osv","ecosystem":"Packagist","package":"guzzlehttp/psr7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1"}]}],"versions":["1.0.0","1.1.0","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.3.1","1.4.0","1.4.1","1.4.2","1.5.0","1.5.1","1.5.2","1.6.0","1.6.1","1.7.0","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.9.0"]},{"source":"osv","ecosystem":"Packagist","package":"guzzlehttp/psr7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.4.5"}]}],"versions":["2.0.0","2.1.0","2.1.1","2.1.2","2.2.0","2.2.1","2.2.2","2.3.0","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4"]},{"source":"osv","ecosystem":"Mageia:8","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.11-1.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php-guzzlehttp-psr7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-1","1.2.0-1","1.2.1-1","1.2.2-1","1.2.2-1build1","1.2.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"php-guzzlehttp-psr7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-0.1+deb10u2build0.20.04.1"}]}],"versions":["1.4.2-0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"php-nyholm-psr7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-2","1.2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"php-guzzlehttp-psr7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1ubuntu0.1~esm1"}]}],"versions":["1.7.0-1","1.8.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"php-nyholm-psr7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-1ubuntu0.1~esm1"}]}],"versions":["1.3.2-2","1.5.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"php-guzzlehttp-psr7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-0.1+deb10u2build0.20.04.1"}]}],"versions":["1.4.2-0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"php-guzzlehttp-psr7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1ubuntu0.1~esm1"}]}],"versions":["1.7.0-1","1.8.3-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"php-nyholm-psr7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-1ubuntu0.1~esm1"}]}],"versions":["1.3.2-2","1.5.0-1"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"guzzle","product":"psr7"},{"vendor":"guzzlephp","product":"psr-7"}],"references":[{"url":"https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96","tags":["x_refsource_MISC","x_transferred","Not Applicable","advisory","web","report"]},{"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-24775","tags":["x_refsource_MISC","x_transferred","Not Applicable","web","report"]},{"url":"https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4","tags":["x_refsource_MISC","x_transferred","Technical Description","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O35UN4IK6VS2LXSRWUDFWY7NI73RKY2U/","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FJANWDXJZE5BGLN4MQ4FEHV5LJ6CMKQF/","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00028.html","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29197","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/psr7/CVE-2023-29197.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wxmh-65f7-jcvw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29197.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-29197","tags":["advisory"]},{"url":"https://github.com/guzzle/psr7","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FJANWDXJZE5BGLN4MQ4FEHV5LJ6CMKQF","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O35UN4IK6VS2LXSRWUDFWY7NI73RKY2U","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2023-0241.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32083","tags":["report"]},{"url":"https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/thread/HVT3U3XYY35PSCIQPHMY4VQNF3Q6MHUO/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-29197","tags":["report"]},{"url":"https://github.com/guzzle/psr7/commit/0454e12ef0cd597ccd2adb036f7bda4e7fface66","tags":["report"]},{"url":"https://github.com/Nyholm/psr7/security/advisories/GHSA-wjfc-pgfp-pv9c","tags":["report"]},{"url":"https://github.com/Nyholm/psr7/commit/1029a2671cbdd3e075a21952082c2be7c8018426","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6670-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6671-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29197","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-24775","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-29197","title":"Improper header name validation in guzzlehttp/psr7","description":"guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\\n) into both the header names and values. While the specification states that \\r\\n\\r\\n is used to terminate the header list, many servers in the wild will also accept \\n\\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.","status":"published","published":"2023-04-17T21:08:46.675Z","modified":"2025-02-13T16:49:01.562Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:35:28.218693Z"}],"euvd":[{"id":"EUVD-2023-1416","description":"guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\\n) into both the header names and values. While the specification states that \\r\\n\\r\\n is used to terminate the header list, many servers in the wild will also accept \\n\\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.","status":"published","published":"2023-04-17T21:08:46Z","modified":"2025-02-13T16:49:01Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:03:50.947767Z"}],"ghsa":[{"id":"GHSA-wxmh-65f7-jcvw","title":"Improper header name validation in guzzlehttp/psr7","description":"### Impact\n\nImproper header parsing. An attacker could sneak in a newline (`\\n`) into both the header names and values. While the specification states that `\\r\\n\\r\\n` is used to terminate the header list, many servers in the wild will also accept `\\n\\n`.\n\n### Patches\n\nThe issue is patched in 1.9.1 and 2.4.5.\n\n### Workarounds\n\nThere are no known workarounds.\n\n### References\n\n* https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4\n","status":"published","published":"2023-04-19T18:25:53Z","modified":"2024-01-09T05:05:27Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:37:30.183224Z"}],"nvd":[{"id":"CVE-2023-29197","description":"guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\\n) into both the header names and values. While the specification states that \\r\\n\\r\\n is used to terminate the header list, many servers in the wild will also accept \\n\\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.","status":"published","published":"2023-04-17T22:15:09.947Z","modified":"2026-06-17T05:49:35.32Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:07:55.652109Z"}],"osv":[{"id":"CVE-2023-29197","title":"Improper header name validation in guzzlehttp/psr7","description":"guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\\n) into both the header names and values. While the specification states that \\r\\n\\r\\n is used to terminate the header list, many servers in the wild will also accept \\n\\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.","status":"published","published":"2023-04-17T21:08:46.675Z","modified":"2026-10-28T02:30:38.583248346Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"DEBIAN-CVE-2023-29197","description":"guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\\n) into both the header names and values. While the specification states that \\r\\n\\r\\n is used to terminate the header list, many servers in the wild will also accept \\n\\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.","status":"published","published":"2023-04-17T22:15:09.947Z","modified":"2026-10-26T18:01:48.510247942Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"GHSA-wxmh-65f7-jcvw","title":"Improper header name validation in guzzlehttp/psr7","description":"### Impact\n\nImproper header parsing. An attacker could sneak in a newline (`\\n`) into both the header names and values. While the specification states that `\\r\\n\\r\\n` is used to terminate the header list, many servers in the wild will also accept `\\n\\n`.\n\n### Patches\n\nThe issue is patched in 1.9.1 and 2.4.5.\n\n### Workarounds\n\nThere are no known workarounds.\n\n### References\n\n* https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4\n","status":"published","published":"2023-04-19T18:25:53Z","modified":"2026-02-04T04:19:33.828903Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"UBUNTU-CVE-2023-29197","description":"guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\\n) into both the header names and values. While the specification states that \\r\\n\\r\\n is used to terminate the header list, many servers in the wild will also accept \\n\\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.","status":"published","published":"2023-04-17T22:15:00Z","modified":"2026-02-04T03:16:53.04067Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"CLSA-2026-1788333194","title":"TuxCare security update for guzzlehttp/psr7 (1 CVE)","description":"TuxCare rebuilt guzzlehttp/psr7 to address 1 CVE. Fixed in 1.1.0-p2+tuxcare.","status":"published","published":"2026-09-02T07:13:14Z","modified":"2026-10-15T09:48:00.536339328Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"DLA-3705-1","title":"php-guzzlehttp-psr7 - security update","status":"published","published":"2023-12-31T00:00:00Z","modified":"2026-03-09T01:21:06.272085Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2023-0241","title":"Updated mediawiki packages fix security vulnerability","description":"guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP.\nAffected versions are subject to improper header parsing. An attacker\ncould sneak in a newline (\\n) into both the header names and values.\nWhile the specification states that \\r\\n\\r\\n is used to terminate the\nheader list, many servers in the wild will also accept \\n\\n\n(CVE-2023-29197).\n\nManualthumb bypasses badFile lookup (CVE-2023-36674).\n\nXSS in BlockLogFormatter due to unsafe message use (CVE-2023-36675).\n","status":"published","published":"2023-07-26T22:07:49Z","modified":"2026-04-16T04:40:59.67570918Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"USN-6670-1","title":"php-guzzlehttp-psr7 vulnerabilities","description":"It was discovered that php-guzzlehttp-psr7 incorrectly parsed HTTP\nheaders. A remote attacker could possibly use these issues to perform\nan HTTP header injection attack.\n","status":"published","published":"2024-02-29T15:52:29Z","modified":"2026-04-27T17:06:40.199735Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-6671-1","title":"php-nyholm-psr7 vulnerability","description":"It was discovered that php-nyholm-psr7 incorrectly parsed HTTP\nheaders. A remote attacker could possibly use this issue to perform\nan HTTP header injection attack.\n","status":"published","published":"2024-02-29T16:02:17Z","modified":"2026-04-27T17:06:38.85562Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}