CVE-2026-55766 Details
Description
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7 did not reject CR/LF characters in certain first-party HTTP start-line fields: the request method, protocol version, and response reason phrase. If an application placed attacker-controlled data into one of those fields and later serialized the PSR-7 message as raw HTTP/1.x, for example with Message::toString() or an equivalent serializer, the serialized message could contain attacker-controlled header lines. The issue can also be reached through Message::parseRequest() or Message::parseResponse() when malformed raw messages are parsed into first-party PSR-7 objects and then serialized again. Creating or modifying a Request, Response, or other PSR-7 object alone is not sufficient. The issue requires the malformed message to be serialized and written to the network, forwarded, replayed, or otherwise processed by software that does not independently reject the malformed start line. This vulnerability is fixed in 2.12.1.
A CRLF injection vulnerability has been identified in the guzzlehttp/psr7 library, prior to version 2.12.1. This vulnerability arises because the library did not properly reject carriage return and line feed characters in certain HTTP start-line fields, including the request method, protocol version, and response reason phrase. As a result, if an application inserted attacker-controlled data into these fields and subsequently serialized the PSR-7 message as raw HTTP/1.x, the serialized message could contain injected header lines. This issue can also occur when malformed raw messages are parsed into PSR-7 objects and then serialized again, potentially leading to header injection, response splitting, request smuggling, or cache poisoning.
Users are advised to upgrade to guzzlehttp/psr7 version 2.12.1 or later, where this vulnerability has been patched. If an immediate upgrade is not possible, untrusted CR/LF characters should be rejected in HTTP method, protocol version, and reason phrase values before creating or modifying PSR-7 messages.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/guzzle/psr7/security/advisories/GHSA-vm85-hxw5-5432 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') | [email protected] |
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| guzzlephp psr-7 | < 2.12.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 30, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |