CVE-2026-55766: Guzzle PSR-7 CRLF injection in HTTP start-line serialization

CVE-2026-55766 · Severity: medium · CVSS 4.8 · Published 2026-06-23

Guzzle PSR-7 is a popular PHP library used for handling web requests and responses. A security flaw allows attackers to inject malicious characters into web messages if the application uses untrusted data to build or parse these messages. This could lead to serious issues like web cache poisoning or bypassing security filters, potentially compromising how data is handled between different web servers.

Technologies: GuzzleHttp Psr7, guzzlehttp/psr7 (Packagist). Vendors: GuzzleHttp, Packagist.

Quick answers

Is CVE-2026-55766 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55766 being exploited in the wild.
How severe is CVE-2026-55766?
Medium severity, with a CVSS score of 4.8, published 23 June 2026.
Which products and versions are affected?
GuzzleHttp Psr7 < 2.12.1; guzzlehttp/psr7 (Packagist) < 2.12.1, ECOSYSTEM:introduced=0,fixed=2.12.1.
Is there a fix for CVE-2026-55766?
Yes. guzzlehttp/psr7 (Packagist): upgrade to 2.12.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55766 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55766?
Check whether you run GuzzleHttp Psr7 or guzzlehttp/psr7 (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • guzzlehttp/psr7 (Packagist): upgrade to 2.12.1 or later
    composer require guzzlehttp/psr7:^2.12.1

Technical details

A CRLF injection vulnerability exists in guzzlehttp/psr7 due to improper neutralization of carriage return and line feed characters in HTTP start-line fields, specifically the request method, protocol version, and response reason phrase. An attacker can exploit this by providing malicious input that is subsequently serialized into a raw HTTP/1.x message using methods like Message::toString(). This can result in HTTP request smuggling, response splitting, or header injection when the malformed message is processed by downstream components. The vulnerability is primarily reachable in applications that manually serialize PSR-7 messages or use custom proxying/crawling logic, rather than standard Guzzle HTTP client usage. The issue is fixed in version 2.12.1.

Affected products

  • Guzzle HTTP psr7 < 2.12.1

Identifiers

  • CVE-2026-55766
  • GHSA-vm85-hxw5-5432

Timeline

  • 2026-06-18: advisory: GitHub Security Advisory published
  • 2026-06-23: disclosed: NVD publication date
  • 2026-06-23: patched: Version 2.12.1 released to address the issue

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.