CVE-2026-55766

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55766", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-17T14:34:51.881Z", "datePublished": "2026-06-23T15:07:36.413Z", "dateUpdated": "2026-06-23T15:49:52.620Z"}, "containers": {"cna": {"title": "guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization", "problemTypes": [{"descriptions": [{"cweId": "CWE-93", "lang": "en", "description": "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-113", "lang": "en", "description": "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/guzzle/psr7/security/advisories/GHSA-vm85-hxw5-5432", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/guzzle/psr7/security/advisories/GHSA-vm85-hxw5-5432"}], "affected": [{"vendor": "guzzle", "product": "psr7", "versions": [{"version": "< 2.12.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-23T15:07:36.413Z"}, "descriptions": [{"lang": "en", "value": "guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7 did not reject CR/LF characters in certain first-party HTTP start-line fields: the request method, protocol version, and response reason phrase. If an application placed attacker-controlled data into one of those fields and later serialized the PSR-7 message as raw HTTP/1.x, for example with Message::toString() or an equivalent serializer, the serialized message could contain attacker-controlled header lines. The issue can also be reached through Message::parseRequest() or Message::parseResponse() when malformed raw messages are parsed into first-party PSR-7 objects and then serialized again. Creating or modifying a Request, Response, or other PSR-7 object alone is not sufficient. The issue requires the malformed message to be serialized and written to the network, forwarded, replayed, or otherwise processed by software that does not independently reject the malformed start line. This vulnerability is fixed in 2.12.1."}], "source": {"advisory": "GHSA-vm85-hxw5-5432", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-23T15:49:11.244663Z", "id": "CVE-2026-55766", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T15:49:52.620Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55766", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-17T14:34:51.881Z", "datePublished": "2026-06-23T15:07:36.413Z", "dateUpdated": "2026-06-23T15:49:52.620Z"}, "containers": {"cna": {"title": "guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization", "problemTypes": [{"descriptions": [{"cweId": "CWE-93", "lang": "en", "description": "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-113", "lang": "en", "description": "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/guzzle/psr7/security/advisories/GHSA-vm85-hxw5-5432", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/guzzle/psr7/security/advisories/GHSA-vm85-hxw5-5432"}], "affected": [{"vendor": "guzzle", "product": "psr7", "versions": [{"version": "< 2.12.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-23T15:07:36.413Z"}, "descriptions": [{"lang": "en", "value": "guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7 did not reject CR/LF characters in certain first-party HTTP start-line fields: the request method, protocol version, and response reason phrase. If an application placed attacker-controlled data into one of those fields and later serialized the PSR-7 message as raw HTTP/1.x, for example with Message::toString() or an equivalent serializer, the serialized message could contain attacker-controlled header lines. The issue can also be reached through Message::parseRequest() or Message::parseResponse() when malformed raw messages are parsed into first-party PSR-7 objects and then serialized again. Creating or modifying a Request, Response, or other PSR-7 object alone is not sufficient. The issue requires the malformed message to be serialized and written to the network, forwarded, replayed, or otherwise processed by software that does not independently reject the malformed start line. This vulnerability is fixed in 2.12.1."}], "source": {"advisory": "GHSA-vm85-hxw5-5432", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55766", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T15:49:11.244663Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T15:49:46.689Z"}}]}}

{"affected": [{"affectedData": [{"product": "psr7", "vendor": "guzzle", "versions": [{"status": "affected", "version": "< 2.12.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:guzzlephp:psr-7:*:*:*:*:*:*:*:*", "matchCriteriaId": "702482D2-3F8A-4A6D-97EC-4E21BB0C62EC", "versionEndExcluding": "2.12.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7 did not reject CR/LF characters in certain first-party HTTP start-line fields: the request method, protocol version, and response reason phrase. If an application placed attacker-controlled data into one of those fields and later serialized the PSR-7 message as raw HTTP/1.x, for example with Message::toString() or an equivalent serializer, the serialized message could contain attacker-controlled header lines. The issue can also be reached through Message::parseRequest() or Message::parseResponse() when malformed raw messages are parsed into first-party PSR-7 objects and then serialized again. Creating or modifying a Request, Response, or other PSR-7 object alone is not sufficient. The issue requires the malformed message to be serialized and written to the network, forwarded, replayed, or otherwise processed by software that does not independently reject the malformed start line. This vulnerability is fixed in 2.12.1."}, {"lang": "es", "value": "guzzlehttp/psr7 es una implementaci\u00f3n de biblioteca de mensajes HTTP PSR-7 en PHP. Antes de la versi\u00f3n 2.12.1, guzzlehttp/psr7 no rechazaba los caracteres CR/LF en ciertos campos de l\u00ednea de inicio HTTP de primera parte: el m\u00e9todo de solicitud, la versi\u00f3n del protocolo y la frase de motivo de respuesta. Si una aplicaci\u00f3n colocaba datos controlados por el atacante en uno de esos campos y luego serializaba el mensaje PSR-7 como HTTP/1.x sin procesar, por ejemplo, con Message::toString() o un serializador equivalente, el mensaje serializado podr\u00eda contener l\u00edneas de encabezado controladas por el atacante. El problema tambi\u00e9n puede alcanzarse a trav\u00e9s de Message::parseRequest() o Message::parseResponse() cuando los mensajes sin procesar malformados se analizan en objetos PSR-7 de primera parte y luego se serializan de nuevo. Crear o modificar un objeto Request, Response u otro objeto PSR-7 por s\u00ed solo no es suficiente. El problema requiere que el mensaje malformado sea serializado y escrito a la red, reenviado, reproducido o procesado de otra manera por software que no rechace de forma independiente la l\u00ednea de inicio malformada. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.12.1."}], "id": "CVE-2026-55766", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55766", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-23T15:49:11.244663Z", "version": "2.0.3"}}]}, "published": "2026-06-23T16:17:03.127", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/guzzle/psr7/security/advisories/GHSA-vm85-hxw5-5432"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-93"}, {"lang": "en", "value": "CWE-113"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.12.1)"}}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "matching"}]}, "original": {"product": "psr7", "source": "cna", "vendor": "guzzle"}, "product": "psr-7", "vendor": "guzzlephp"}], "created": "2026-06-23T17:30:05.734854+00:00", "updated": "2026-06-24T16:06:00.905357+00:00", "vendors": ["guzzlephp", "guzzlephp$PRODUCT$psr-7"]}