GHSA-wjfc-pgfp-pv9c Improper Input Validation in nyholm/psr7
Attackers can inject newlines into HTTP headers via improper input validation in the nyholm/psr7 library, potentially causing request smuggling or header injection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-wjfc-pgfp-pv9c?
GHSA-wjfc-pgfp-pv9c is a vulnerability in nyholm/psr7, published on 21 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
Improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n.
Patches
The issue is patched in 1.6.1.
Workarounds
There are no known workarounds.
References
Which versions are affected by GHSA-wjfc-pgfp-pv9c?
2 open source packages ship an affected version, including nyholm/psr7.
| Package | Affected | Fixed in |
|---|---|---|
nyholm/psr7 Packagist | All versions | 1.6.1 |
nyholm/psr7 Packagist | All versions | 1.6.1 |
How do I fix GHSA-wjfc-pgfp-pv9c?
Upgrade nyholm/psr7 to 1.6.1 or later.
Is GHSA-wjfc-pgfp-pv9c being exploited?
There is no known exploitation of GHSA-wjfc-pgfp-pv9c in the wild and no public exploit code.