Lack of data validation In guzzlehttp/psr7
Description
Improper Input Validation in guzzlehttp/psr7
Impact
Improper header parsing. An attacker could sneak in a carriage return character (\r) and pass untrusted values in both the header names and values.
Patches
The issue is patched in 1.8.4 and 2.1.1.
Workarounds
There are no known workarounds.
References
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 packagist | 1.8.4, 2.1.1 | ||
 debian 11 | 1.7.0-1+deb11u1 | ||
packagist | 9.2.16, 9.3.9 | ||
debian 12 | 1.8.5-1 | ||
debian 13 | 1.8.5-1 | ||
packagist | 9.2.16, 9.3.9 | ||
debian 14 | 1.8.5-1 |
Aliases
1. 2. 3. 4. 5. 6. 7. 8.
References
1. 2. 3. 4. 5. 6.