Vulnerability in Guzzle Psr7
CVE-2023-29197
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.
EPSS: 0.012 (66.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Guzzle Psr7 — versions < 1.9.1, >= 2.0.0, < 2.4.5
- Guzzlephp Psr-7
- Fedoraproject Fedora — versions 37, 38
Weakness classification (CWE)
Public proof-of-concept exploits
- 20142995/nuclei-templates
- DannyvdSluijs/DannyvdSluijs
- blue-goheimochi/phpcon-nagoya2025
- common-repository/amazon-s3-and-cloudfront
- common-repository/wp-ses
- deliciousbrains/wp-amazon-s3-and-cloudfront
- deliciousbrains/wp-offload-ses-lite
- elifesciences/github-repo-security-alerts
- karimhabush/cyberowl
- zerosickk/amazon-s3-and-cloudfront
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (x_refsource_MISC, Not Applicable)
- security-advisories@github.com (x_refsource_MISC, Not Applicable)
- security-advisories@github.com (Technical Description, x_refsource_MISC)
- security-advisories@github.com (Mailing List, Third Party Advisory)
- security-advisories@github.com (Mailing List, Third Party Advisory)
- security-advisories@github.com
Frequently asked questions
- What is CVE-2023-29197?
- CVE-2023-29197 is a medium-severity vulnerability in Guzzle Psr7, classified under CWE-436. CVSS score: 5.3/10. Published 2023-04-17.
- How severe is CVE-2023-29197?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2023-29197 known to be exploited?
- 10 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.