CVE-2023-29197

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-436

Affected software

No affected versions have been published.

Timeline

Published
Apr 17, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-291988.5Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps using `contexCVE-2023-2919910.0There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers CVE-2023-292006.5Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system CVE-2023-292019.0XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, CVE-2023-292029.0XWiki Commons are technical libraries common to several other top level XWiki projects. The RSS macro that is bundled in XWiki included the CVE-2023-292035.3XWiki Commons are technical libraries common to several other top level XWiki projects. It's possible to list some users who are normally noCVE-2023-292046.1XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measuCVE-2023-292055.4XWiki Commons are technical libraries common to several other top level XWiki projects. The HTML macro does not systematically perform a proCVE-2023-292065.4XWiki Commons are technical libraries common to several other top level XWiki projects. There was no check in the author of a JavaScript xobCVE-2023-292079.0XWiki Commons are technical libraries common to several other top level XWiki projects. The Livetable Macro wasn't properly sanitizing columCVE-2023-292087.5XWiki Commons are technical libraries common to several other top level XWiki projects. Rights added to a document are not taken into accounCVE-2023-292098.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible doc
CVE-2023-29197: High severity, CVSS 7.5 | Vulnix