What’s Vulnerable › Vulnerabilities
CVE-2026-55766: guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization
- Severity: medium (CVSS 4.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-23 · updated 2026-10-25
- Weakness: CWE-93
Description
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7 did not reject CR/LF characters in certain first-party HTTP start-line fields: the request method, protocol version, and response reason phrase. If an application placed attacker-controlled data into one of those fields and later serialized the PSR-7 message as raw HTTP/1.x, for example with Message::toString() or an equivalent serializer, the serialized message could contain attacker-controlled header lines. The issue can also be reached through Message::parseRequest() or Message::parseResponse() when malformed raw messages are parsed into first-party PSR-7 objects and then serialized again. Creating or modifying a Request, Response, or other PSR-7 object alone is not sufficient. The issue requires the malformed message to be serialized and written to the network, forwarded, replayed, or otherwise processed by software that does not independently reject the malformed start line. This vulnerability is fixed in 2.12.1.
Affected products
- Guzzlephp Psr-7: before 2.12.1 — fixed in 2.12.1
- Packagist Guzzlehttp/Psr7: before 2.12.1; 1.0.0, 1.1.0, 1.2.0, 1.2.1, 1.2.2, 1.2.3 (+55) — fixed in 2.12.1
How to fix
Upgrade to a fixed version: Guzzlephp Psr-7 2.12.1; Packagist Guzzlehttp/Psr7 2.12.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-55766 or the next vulnerability affects your stack