CVE-2023-29197: Improper header name validation in guzzlehttp/psr7

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-04-17 · updated 2026-06-17
Weakness: CWE-436

Description

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.

Affected products

Fedoraproject Fedora: 37, 38
Guzzlephp Psr-7: before 1.9.1; from 2.0.0 before 2.4.5 — fixed in 1.9.1, 2.4.5
Packagist Guzzlehttp/Psr7: before 1.9.1; from 2.0.0 before 2.4.5; 1.0.0, 1.1.0, 1.2.0, 1.2.1, 1.2.2, 1.2.3 (+31) — fixed in 1.9.1, 2.4.5

How to fix

Upgrade to a fixed version: Guzzlephp Psr-7 1.9.1, 2.4.5; Packagist Guzzlehttp/Psr7 1.9.1, 2.4.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-29197 or the next vulnerability affects your stack