Vulnerability Database

289,689

Total vulnerabilities in the database

CVE-2022-24775

guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.

CVSS v3:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v2:

  • Severity: Medium
  • Score: 5
  • AV:N/AC:L/Au:N/C:N/I:P/A:N

CWEs:

Software From Fixed in
drupal / drupal 9.3.0 9.3.9
drupal / drupal 8.0.0 9.2.16
guzzlephp / psr-7 2.0.0 2.1.1
guzzlephp / psr-7 - 1.8.4
guzzlehttp / psr7 - 1.8.4
guzzlehttp / psr7 2.0.0 2.1.1