Description
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| guzzle | psr7 | < 1.8.4, >= 2.0.0, < 2.1.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | php-guzzlehttp-psr7 | 1.8.5-1 | — |
| Debian 13 | php-guzzlehttp-psr7 | 1.8.5-1 | — |
| Debian 12 | php-guzzlehttp-psr7 | 1.8.5-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | php-guzzlehttp-psr7 | 1.4.2-0.1+deb10u2build0.20.04.1 | USN-6670-1 |
| Ubuntu 16.04 LTS | php-guzzlehttp-psr7 | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | php-guzzlehttp-psr7 | 1.8.3-1ubuntu0.1~esm1 | USN-6670-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | drupal/core | >= 8.0.0, < 9.2.16 · >= 9.3.0, < 9.3.9 | 9.2.16, 9.3.9 | DRUPAL-CORE-2022-006 |
| Packagist | guzzlehttp/psr7 | < 1.8.4 | 1.8.4 | GHSA-q7rv-6hp3-vh96 |
| Packagist | guzzlehttp/psr7 | >= 2.0.0, < 2.1.1 | 2.1.1 | GHSA-q7rv-6hp3-vh96 |
Advisories 1
- USN-6670-1 php-guzzlehttp-psr7 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026