CVE-2022-24775

Name of the Vulnerable Software and Affected Versions guzzlehttp/psr7 versions prior to 1.8.4 and 2.1.1

Description The issue is related to improper header parsing in the guzzlehttp/psr7 library. An attacker could sneak in a new line character and pass untrusted values in both the header names and values. This could potentially allow a remote attacker to impact the integrity of protected information.

Recommendations For versions prior to 1.8.4, update to version 1.8.4 or later. For versions prior to 2.1.1, update to version 2.1.1 or later. As a temporary workaround, consider validating HTTP header keys and/or values, and if using user-supplied values, filter them to strip off leading or trailing newline characters before calling withHeader().