CVE-2023-29197 - CVE House
Back to Database
Status published Medium CVE-2023-29197

Improper header name validation in guzzlehttp/psr7

Vulnerability Description

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-29197

Credits & Attribution

No credits recorded in the NVD database.

References

More from guzzle

View All →
CVE-2025-21617
Guzzle OAuth Subscriber has insufficient nonce entropy
Medium 6.3
CVE-2022-31091
Change in port should be considered a change in origin in Guzzle
High 7.7
CVE-2022-31090
CURLOPT_HTTPAUTH option not cleared on change of origin in Guzzle
High 7.7
CVE-2022-31043
Fix failure to strip Authorization header on HTTP downgrade in Guzzle
High 7.5
CVE-2022-31042
Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle
High 7.5

Affected Vendor

Affected Software

psr7
Vulnerable Versions:
< 1.9.1, >= 2.0.0, < 2.4.5

Timeline

Official Publish: April 17th, 2023
Last Modified: February 13th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-436

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.