CVE-2026-55766 guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization
Attackers can inject CRLF characters into HTTP start lines, potentially smuggling headers or bypassing security controls in applications using this PHP library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55766?
CVE-2026-55766 is a medium-severity vulnerability in guzzle psr7, published on 23 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7 did not reject CR/LF characters in certain first-party HTTP start-line fields: the request method, protocol version, and response reason phrase. If an application placed attacker-controlled data into one of those fields and later serialized the PSR-7 message as raw HTTP/1.x, for example with Message::toString() or an equivalent serializer, the serialized message could contain attacker-controlled header lines. The issue can also be reached through Message::parseRequest() or Message::parseResponse() when malformed raw messages are parsed into first-party PSR-7 objects and then serialized again. Creating or modifying a Request, Response, or other PSR-7 object alone is not sufficient. The issue requires the malformed message to be serialized and written to the network, forwarded, replayed, or otherwise processed by software that does not independently reject the malformed start line. This vulnerability is fixed in 2.12.1.
Which versions are affected by CVE-2026-55766?
2 open source packages ship an affected version, including guzzlehttp/psr7. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
guzzlehttp/psr7 Packagist | All versions | 2.12.1 |
guzzlehttp/psr7 Packagist | All versions | 2.12.1 |
Products include Guzzlephp Psr-7.
How do I fix CVE-2026-55766?
Upgrade guzzlehttp/psr7 to 2.12.1 or later.
Is CVE-2026-55766 being exploited?
There is no known exploitation of CVE-2026-55766 in the wild and no public exploit code.
Other vulnerabilities in guzzle psr7
Sources
Also known as DEBIAN-CVE-2026-55766, GHSA-vm85-hxw5-5432, MINI-8mpm-qhjm-9x9c, MINI-925x-6p24-wjvj, MINI-c292-gfhg-xpm8, MINI-p886-mfv8-8hgr and 4 more.