CVE-2026-55766

Name of the Vulnerable Software and Affected Versions guzzlehttp/psr7 versions prior to 2.12.1

Description guzzlehttp/psr7 fails to reject Carriage Return (CR) and Line Feed (LF) characters in specific HTTP start-line fields, including the request method, protocol version, and response reason phrase. This occurs when attacker-controlled data is placed in these fields and subsequently serialized as raw HTTP/1.x using functions such as Message::toString() or equivalent serializers. The issue can also be triggered via Message::parseRequest() or Message::parseResponse() when malformed raw messages are parsed into PSR-7 objects and then re-serialized. For exploitation to occur, the malformed message must be serialized and processed by software that does not independently reject malformed start lines. This may lead to header injection, response splitting, request smuggling, or cache poisoning. Applications using standard Guzzle HTTP client APIs are not expected to be affected; the risk is higher for those manually serializing messages, forwarding raw HTTP, or implementing custom transports, proxying, and webhooks.

Recommendations Update to version 2.12.1 or later. As a temporary workaround, reject CR/LF characters in untrusted method, protocol version, and reason phrase values before constructing or modifying PSR-7 messages. Validate the raw start line before calling Message::parseRequest() or Message::parseResponse() and avoid reparsing untrusted raw messages. Validate REQUEST METHOD and SERVER PROTOCOL before calling ServerRequest::fromGlobals() if the application operates with attacker-controlled synthetic $ SERVER values.