CVE-2026-55766: guzzlehttp/psr7 CR/LF Injection in HTTP Start-Line Fields

Technical summary

guzzlehttp/psr7 versions prior to 2.12.1 permit CR/LF injection into HTTP message start-line fields (request method, HTTP protocol version, response reason phrase). When a PSR-7 Message object is serialized via Message::toString() or equivalent mechanisms, these unvalidated characters can introduce unauthorized header lines into the raw HTTP output. The attack vector also includes parsing malformed raw HTTP via Message::parseRequest() or Message::parseResponse(), then re-serializing the parsed object. The vulnerability aligns with CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers) and CWE-93 (Improper Neutralization of CRLF Sequences in a HTTP Response). Exploitation requires downstream processing of the malformed serialized message—direct object manipulation alone does not trigger the flaw.

Business impact

Applications relying on psr7 for HTTP message handling face header injection risks if they accept user input, serialize messages, and transmit or forward those messages across trust boundaries. This could enable attackers to inject fake headers, authenticate as different users, manipulate response caching, or bypass security middleware. The actual risk depends heavily on application architecture: frameworks that validate message structure independently or reject malformed input on receipt are less exposed. Organizations using psr7 in request-building or response-forwarding logic should prioritize assessment of their data flow.

Affected systems

All versions of guzzlehttp/psr7 prior to 2.12.1 are affected. The vulnerability impacts PHP applications that use psr7 and pass user-controlled data into HTTP message start-line fields. Secondary exposure occurs when applications parse raw HTTP input into PSR-7 objects without independent validation, then re-serialize and transmit those messages.

Exploitability

Exploitation requires multiple conditions: attacker control over start-line fields, serialization to HTTP/1.x format, and downstream processing that does not independently validate message syntax. The CVSS 4.8 MEDIUM score reflects this complexity. Active exploitation is not documented (KEV status: not listed). The attack surface is real but constrained by typical defensive practices (input validation, output encoding) already in place in mature applications.

Remediation

Upgrade guzzlehttp/psr7 to version 2.12.1 or later. If immediate upgrade is infeasible, applications should implement input validation to reject CR/LF characters in any user-controlled data destined for HTTP start-line fields before passing it to psr7. Additionally, validate serialized HTTP messages before transmission or forwarding.

Patch guidance

Update guzzlehttp/psr7 to 2.12.1 or a later release via composer update guzzlehttp/psr7. Verify the updated version by checking composer.lock or running composer show guzzlehttp/psr7. Test serialization behavior on your application's request and response handling paths to confirm the fix does not introduce compatibility issues with legacy upstream or downstream systems.

Detection guidance

Monitor application logs and network traffic for unusual CR/LF sequences in HTTP start lines. When psr7 is deployed, audit code paths that accept user input and pass it to message start-line fields; confirm that serialized output is either discarded or validated before transmission. Security testing tools that fuzz HTTP message construction with CR/LF payloads can identify vulnerable code patterns. Runtime monitoring for unexpected additional headers in outbound HTTP may surface exploitation attempts.

Why prioritize this

While CVSS is MEDIUM (4.8) and the vulnerability is not yet widely exploited, organizations using psr7 in request-building or forwarding roles should prioritize patching because header injection flaws can enable authentication bypass, cache poisoning, and security control circumvention. The fix is low-risk (a library update) and adoption should be straightforward for most PHP projects.

Risk score, explained

The CVSS 3.1 score of 4.8 reflects low-to-moderate impact: CR/LF injection enables header manipulation (confidentiality and integrity concerns) but only under specific conditions (high complexity, no direct network elevation of privilege, no availability impact). The score accounts for the requirement that serialization and downstream processing both occur without independent validation. Absence from the KEV catalog indicates no evidence of active in-the-wild exploitation.

Frequently asked questions