CVE catalog

CVE-2023-29197

php-guzzlehttp-psr7: CVE-2023-29197

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.22% · Oct 25, 2026

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianphp-nyholm-psr7sid1.8.2-2fixed
Debianphp-nyholm-psr7forky1.8.2-2fixed
Debianphp-nyholm-psr7trixie1.8.2-2fixed
Debianphp-nyholm-psr7bookworm1.5.1-2fixed
Debianphp-guzzlehttp-psr7sid2.13.1-1fixed
Debianphp-guzzlehttp-psr7forky2.13.1-1fixed
Debianphp-guzzlehttp-psr7trixie2.7.1-1+deb13u2fixed
Debianphp-guzzlehttp-psr7bookworm2.4.5-1+deb12u1fixed
Ubuntuphp-nyholm-psr7pro1.3.2-2vulnerable
Ubuntuphp-nyholm-psr7pro1.5.0-1vulnerable
Ubuntuphp-nyholm-psr7pro1.5.0-1ubuntu0.1~esm1fixed
Ubuntuphp-guzzlehttp-psr716.041.1.0-1vulnerable
Ubuntuphp-guzzlehttp-psr716.041.2.0-1vulnerable
Ubuntuphp-guzzlehttp-psr716.041.2.1-1vulnerable
Ubuntuphp-guzzlehttp-psr716.041.2.2-1vulnerable
Ubuntuphp-guzzlehttp-psr716.041.2.2-1build1vulnerable
Ubuntuphp-guzzlehttp-psr716.041.2.2-1ubuntu1vulnerable
Ubuntuphp-guzzlehttp-psr720.041.4.2-0.1vulnerable
Ubuntuphp-guzzlehttp-psr720.041.4.2-0.1+deb10u2build0.20.04.1fixed
Ubuntuphp-nyholm-psr720.041.1.0-2vulnerable
Ubuntuphp-nyholm-psr720.041.2.1-2vulnerable
Ubuntuphp-guzzlehttp-psr7pro1.7.0-1vulnerable
Ubuntuphp-guzzlehttp-psr7pro1.8.3-1vulnerable
Ubuntuphp-guzzlehttp-psr7pro1.8.3-1ubuntu0.1~esm1fixed
Ubuntuphp-nyholm-psr7pro1.3.2-2vulnerable
Ubuntuphp-nyholm-psr7pro1.5.0-1vulnerable
Ubuntuphp-nyholm-psr7pro1.5.0-1ubuntu0.1~esm1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianphp-nyholm-psr7sourcesid1.5.1-2not yet assignedNot reported[1034597]
Debianphp-nyholm-psr7sourceforky1.5.1-2not yet assignedNot reported[1034597]
Debianphp-nyholm-psr7sourcetrixie1.5.1-2not yet assignedNot reported[1034597]
Debianphp-nyholm-psr7sourcebookworm1.5.1-2not yet assignedNot reported[1034597]
Debianphp-guzzlehttp-psr7sourcesid2.4.5-1not yet assignedNot reported[1034581]
Debianphp-guzzlehttp-psr7sourceforky2.4.5-1not yet assignedNot reported[1034581]
Debianphp-guzzlehttp-psr7sourcetrixie2.4.5-1not yet assignedNot reported[1034581]
Debianphp-guzzlehttp-psr7sourcebookworm2.4.5-1not yet assignedNot reported[1034581]
Ubuntuphp-nyholm-psr7debpro1.5.0-1ubuntu0.1~esm1Not reportedUSN-6671-1Not reported
Ubuntuphp-guzzlehttp-psr7deb20.041.4.2-0.1+deb10u2build0.20.04.1Not reportedUBUNTU-CVE-2023-29197Not reported
Ubuntuphp-guzzlehttp-psr7debpro1.8.3-1ubuntu0.1~esm1Not reportedUBUNTU-CVE-2023-29197Not reported
Ubuntuphp-nyholm-psr7debpro1.5.0-1ubuntu0.1~esm1Not reportedUBUNTU-CVE-2023-29197Not reported

[Debian bug #1034597][Debian bug #1034581]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]