Executive brief
Guzzle PSR-7 is a popular PHP library used for handling web requests and responses. A security flaw allows attackers to inject malicious characters into web messages if the application uses untrusted data to build or parse these messages. This could lead to serious issues like web cache poisoning or bypassing security filters, potentially compromising how data is handled between different web servers.
Technical details
A CRLF injection vulnerability exists in guzzlehttp/psr7 due to improper neutralization of carriage return and line feed characters in HTTP start-line fields, specifically the request method, protocol version, and response reason phrase. An attacker can exploit this by providing malicious input that is subsequently serialized into a raw HTTP/1.x message using methods like Message::toString(). This can result in HTTP request smuggling, response splitting, or header injection when the malformed message is processed by downstream components. The vulnerability is primarily reachable in applications that manually serialize PSR-7 messages or use custom proxying/crawling logic, rather than standard Guzzle HTTP client usage. The issue is fixed in version 2.12.1.
Affected products
- Guzzle HTTP psr7 < 2.12.1
Timeline
- 2026-06-18: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date
- 2026-06-23: patched: Version 2.12.1 released to address the issue