Description
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| guzzle | psr7 | < 1.9.1, >= 2.0.0, < 2.4.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | php-guzzlehttp-psr7 | 2.4.5-1 | — |
| Debian 14 | php-nyholm-psr7 | 1.5.1-2 | — |
| Debian 13 | php-guzzlehttp-psr7 | 2.4.5-1 | — |
| Debian 13 | php-nyholm-psr7 | 1.5.1-2 | — |
| Debian 12 | php-guzzlehttp-psr7 | 2.4.5-1 | — |
| Debian 12 | php-nyholm-psr7 | 1.5.1-2 | — |
| Debian 10 | php-guzzlehttp-psr7 | 1.4.2-0.1+deb10u2 | DLA-3705-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | php-guzzlehttp-psr7 | 1.4.2-0.1+deb10u2build0.20.04.1 | USN-6670-1 |
| Ubuntu 20.04 LTS | php-nyholm-psr7 | No fix yet | — |
| Ubuntu 16.04 LTS | php-guzzlehttp-psr7 | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | php-guzzlehttp-psr7 | 1.8.3-1ubuntu0.1~esm1 | USN-6670-1 |
| Ubuntu Pro 22.04 LTS | php-nyholm-psr7 | 1.5.0-1ubuntu0.1~esm1 | USN-6671-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | guzzlehttp/psr7 | < 1.9.1 | 1.9.1 | GHSA-wxmh-65f7-jcvw |
| Packagist | guzzlehttp/psr7 | >= 2.0.0, < 2.4.5 | 2.4.5 | GHSA-wxmh-65f7-jcvw |
Advisories 4
- USN-6670-1 php-guzzlehttp-psr7 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- USN-6671-1 php-nyholm-psr7 vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-3705-1 php-guzzlehttp-psr7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2023-1626 MediaWiki: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024
References
- https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw
- https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-24775
- https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O35UN4IK6VS2LXSRWUDFWY7NI73RKY2U/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FJANWDXJZE5BGLN4MQ4FEHV5LJ6CMKQF/
- https://lists.debian.org/debian-lts-announce/2023/12/msg00028.html