CVE-2023-29197
published 2023-04-17CVE-2023-29197: guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
ITW
Exploited in the wild
EPSS
1.22%
65.1th percentile
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| codeigniter4 | framework | >= 0 < 4.5.8 | 4.5.8 |
| debian | php-guzzlehttp-psr7 | < php-guzzlehttp-psr7 2.4.5-1 (bookworm) | php-guzzlehttp-psr7 2.4.5-1 (bookworm) |
| debian | php-nyholm-psr7 | < php-guzzlehttp-psr7 2.4.5-1 (bookworm) | php-guzzlehttp-psr7 2.4.5-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| guzzlehttp | psr7 | >= 0 < 1.9.1 | 1.9.1 |
| guzzlehttp | psr7 | >= 2.0.0 < 2.4.5 | 2.4.5 |
| guzzlephp | psr-7 | < 1.9.1 | 1.9.1 |
| guzzlephp | psr-7 | >= 2.0.0 < 2.4.5 | 2.4.5 |
| laminas | laminas-diactoros | >= 0 < 2.18.1 | 2.18.1 |
| laminas | laminas-diactoros | >= 2.19.0 < 2.19.1 | 2.19.1 |
| laminas | laminas-diactoros | >= 2.20.0 < 2.20.1 | 2.20.1 |
| laminas | laminas-diactoros | >= 2.21.0 < 2.21.1 | 2.21.1 |
| laminas | laminas-diactoros | >= 2.22.0 < 2.22.1 | 2.22.1 |
| laminas | laminas-diactoros | >= 2.23.0 < 2.23.1 | 2.23.1 |
| laminas | laminas-diactoros | >= 2.24.0 < 2.24.2 | 2.24.2 |
| laminas | laminas-diactoros | >= 2.25.0 < 2.25.2 | 2.25.2 |
| slim | psr7 | >= 0 < 1.4.1 | 1.4.1 |
| slim | psr7 | >= 1.5 < 1.5.1 | 1.5.1 |
| slim | psr7 | >= 1.6 < 1.6.1 | 1.6.1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
ghsa7.5HIGH
osv7.5HIGH
vendor_debian7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Missing validation of header name and value in codeigniter4/framework
ghsa·2025-01-21·CVSS 7.5
CVE-2025-24013 [HIGH] CWE-436 Missing validation of header name and value in codeigniter4/framework
Missing validation of header name and value in codeigniter4/framework
### Impact
Lack of proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with `Header` class. This could disrupt application functionality, potentially causing errors or generating invalid HTTP requests. In some cases, these malformed requests might lead to a DoS scenario if a remote service’s web application firewall interprets them as malicious and blocks further communication with the application.
### Patches
Upgrade to v4.5.8 or later.
### Workarounds
Validate HTTP header keys and/or values if using user-supplied values before passing them to `Header` class.
### Differences from CVE-2023-29197
1. **Affected Software**:
* CVE-2023-29197 specifically a
OSV
Missing validation of header name and value in codeigniter4/framework
osv·2025-01-21·CVSS 7.5
CVE-2025-24013 [HIGH] Missing validation of header name and value in codeigniter4/framework
Missing validation of header name and value in codeigniter4/framework
### Impact
Lack of proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with `Header` class. This could disrupt application functionality, potentially causing errors or generating invalid HTTP requests. In some cases, these malformed requests might lead to a DoS scenario if a remote service’s web application firewall interprets them as malicious and blocks further communication with the application.
### Patches
Upgrade to v4.5.8 or later.
### Workarounds
Validate HTTP header keys and/or values if using user-supplied values before passing them to `Header` class.
### Differences from CVE-2023-29197
1. **Affected Software**:
* CVE-2023-29197 specifically a
GHSA
HTTP Multiline Header Termination
ghsa·2023-04-24·CVSS 7.5
CVE-2023-29530 [HIGH] CWE-20 HTTP Multiline Header Termination
HTTP Multiline Header Termination
### Impact
Affected versions of Laminas Diactoros accepted a single line feed (LF / `\n` ) character at the end of a header name. When serializing such a header name containing a line-feed into the on-the-wire representation of a HTTP/1.x message, the resulting message would be syntactically invalid, due to the header line being terminated too early. An attacker that is able to control the header names that are passed to Laminas Diactoros would be able to intentionally craft invalid messages, possibly causing application errors or invalid HTTP requests being sent out with an PSR-18 HTTP client. The latter might present a denial of service vector if a remote service’s web application firewall bans the application due to the receipt of malformed requests.
OSV
HTTP Multiline Header Termination
osv·2023-04-24·CVSS 7.5
CVE-2023-29530 [HIGH] HTTP Multiline Header Termination
HTTP Multiline Header Termination
### Impact
Affected versions of Laminas Diactoros accepted a single line feed (LF / `\n` ) character at the end of a header name. When serializing such a header name containing a line-feed into the on-the-wire representation of a HTTP/1.x message, the resulting message would be syntactically invalid, due to the header line being terminated too early. An attacker that is able to control the header names that are passed to Laminas Diactoros would be able to intentionally craft invalid messages, possibly causing application errors or invalid HTTP requests being sent out with an PSR-18 HTTP client. The latter might present a denial of service vector if a remote service’s web application firewall bans the application due to the receipt of malformed requests.
OSV
Improper header name validation in guzzlehttp/psr7
osv·2023-04-19
CVE-2023-29197 [MEDIUM] Improper header name validation in guzzlehttp/psr7
Improper header name validation in guzzlehttp/psr7
### Impact
Improper header parsing. An attacker could sneak in a newline (`\n`) into both the header names and values. While the specification states that `\r\n\r\n` is used to terminate the header list, many servers in the wild will also accept `\n\n`.
### Patches
The issue is patched in 1.9.1 and 2.4.5.
### Workarounds
There are no known workarounds.
### References
* https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4
GHSA
Improper header name validation in guzzlehttp/psr7
ghsa·2023-04-19
CVE-2023-29197 [MEDIUM] CWE-436 Improper header name validation in guzzlehttp/psr7
Improper header name validation in guzzlehttp/psr7
### Impact
Improper header parsing. An attacker could sneak in a newline (`\n`) into both the header names and values. While the specification states that `\r\n\r\n` is used to terminate the header list, many servers in the wild will also accept `\n\n`.
### Patches
The issue is patched in 1.9.1 and 2.4.5.
### Workarounds
There are no known workarounds.
### References
* https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4
GHSA
Insecure header validation in slim/psr7
ghsa·2023-04-18·CVSS 7.5
CVE-2023-30536 [HIGH] CWE-436 Insecure header validation in slim/psr7
Insecure header validation in slim/psr7
### Impact
An attacker could sneak in a newline (`\n`) into both the header names and values. While the specification states that `\r\n\r\n` is used to terminate the header list, many servers in the wild will also accept `\n\n`. An attacker that is able to control the header names that are passed to Slilm-Psr7 would be able to intentionally craft invalid messages, possibly causing application errors or invalid HTTP requests being sent out with an PSR-18 HTTP client. The latter might present a denial of service vector if a remote service’s web application firewall bans the application due to the receipt of malformed requests.
### Patches
The issue is patched in 1.6.1, 1.5.1, and 1.4.1.
### Workarounds
In Slim-Psr7 prior to 1.6.1, 1.5.1, and 1.4.
OSV
Insecure header validation in slim/psr7
osv·2023-04-18·CVSS 7.5
CVE-2023-30536 [HIGH] Insecure header validation in slim/psr7
Insecure header validation in slim/psr7
### Impact
An attacker could sneak in a newline (`\n`) into both the header names and values. While the specification states that `\r\n\r\n` is used to terminate the header list, many servers in the wild will also accept `\n\n`. An attacker that is able to control the header names that are passed to Slilm-Psr7 would be able to intentionally craft invalid messages, possibly causing application errors or invalid HTTP requests being sent out with an PSR-18 HTTP client. The latter might present a denial of service vector if a remote service’s web application firewall bans the application due to the receipt of malformed requests.
### Patches
The issue is patched in 1.6.1, 1.5.1, and 1.4.1.
### Workarounds
In Slim-Psr7 prior to 1.6.1, 1.5.1, and 1.4.
OSV
CVE-2023-29197: guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP
osv·2023-04-17·CVSS 7.5
CVE-2023-29197 [HIGH] CVE-2023-29197: guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.
Ubuntu
php-nyholm-psr7 vulnerability
vendor_ubuntu·2024-02-29
CVE-2023-29197 php-nyholm-psr7 vulnerability
Title: php-nyholm-psr7 vulnerability
Summary: An header injection issue was fixed in php-nyholm-psr7.
It was discovered that php-nyholm-psr7 incorrectly parsed HTTP
headers. A remote attacker could possibly use this issue to perform
an HTTP header injection attack.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
php-guzzlehttp-psr7 vulnerabilities
vendor_ubuntu·2024-02-29
CVE-2023-29197 php-guzzlehttp-psr7 vulnerabilities
Title: php-guzzlehttp-psr7 vulnerabilities
Summary: Several header injection issues were fixed in php-guzzlehttp-psr7.
It was discovered that php-guzzlehttp-psr7 incorrectly parsed HTTP
headers. A remote attacker could possibly use these issues to perform
an HTTP header injection attack.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2023-29197: php-guzzlehttp-psr7 - guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected ...
vendor_debian·2023·CVSS 7.5
CVE-2023-29197 [HIGH] CVE-2023-29197: php-guzzlehttp-psr7 - guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected ...
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.
Scope: local
bookworm: resolved (fixed in 2.4.5-1)
bullseye: resolved (fixed in 1.7.0-1+deb11u2)
forky: resolved (fixed in 2.4.5-1)
sid: resolved (fixed in 2.4.5-1)
trixie: resolved (fixed in 2.4.5-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-24775https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvwhttps://lists.debian.org/debian-lts-announce/2023/12/msg00028.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/FJANWDXJZE5BGLN4MQ4FEHV5LJ6CMKQF/https://lists.fedoraproject.org/archives/list/[email protected]/message/O35UN4IK6VS2LXSRWUDFWY7NI73RKY2U/https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-24775https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvwhttps://lists.debian.org/debian-lts-announce/2023/12/msg00028.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/FJANWDXJZE5BGLN4MQ4FEHV5LJ6CMKQF/https://lists.fedoraproject.org/archives/list/[email protected]/message/O35UN4IK6VS2LXSRWUDFWY7NI73RKY2U/https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4
2023-04-17
Published
Exploited in the wild