CVE-2023-29197

MEDIUM IN THE WILD

guzzlehttp/psr7 <1.9.1, <2.4.5 - XSS

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-29197 has been observed exploited in the wild (reported by InTheWild.io).

Description

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.

References (7)

Core 7

Scores

CVSS v3 5.3
EPSS 0.0122
EPSS Percentile 64.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Details

InTheWild.io 2023-04-17
CWE
CWE-436
Status published
Products (4)
fedoraproject/fedora 37
fedoraproject/fedora 38
guzzlehttp/psr7 0 - 1.9.1Packagist
guzzlephp/psr-7 < 1.9.1
Published Apr 17, 2023
Tracked Since Feb 18, 2026