Back to Database
Status published
High
CVE-2022-24775
Improper Input Validation in guzzlehttp/psr7
Vulnerability Description
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-24775
Credits & Attribution
No credits recorded in the NVD database.
References
More from guzzle
View All →CVE-2025-21617
Guzzle OAuth Subscriber has insufficient nonce entropy
Medium
6.3
CVE-2023-29197
Improper header name validation in guzzlehttp/psr7
Medium
5.3
CVE-2022-31091
Change in port should be considered a change in origin in Guzzle
High
7.7
CVE-2022-31090
CURLOPT_HTTPAUTH option not cleared on change of origin in Guzzle
High
7.7
CVE-2022-31043
Fix failure to strip Authorization header on HTTP downgrade in Guzzle
High
7.5
Affected Vendor
guzzle
View all reports →Affected Software
psr7
Vulnerable Versions:
< 1.8.4, >= 2.0.0, < 2.1.1
Timeline
Official Publish:
March 21st, 2022
Last Modified:
April 23rd, 2025
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N