CVE-2026-55766

{
  "id": "CVE-2026-55766",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-23T16:17:03.127",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7 did not reject CR/LF characters in certain first-party HTTP start-line fields: the request method, protocol version, and response reason phrase. If an application placed attacker-controlled data into one of those fields and later serialized the PSR-7 message as raw HTTP/1.x, for example with Message::toString() or an equivalent serializer, the serialized message could contain attacker-controlled header lines. The issue can also be reached through Message::parseRequest() or Message::parseResponse() when malformed raw messages are parsed into first-party PSR-7 objects and then serialized again. Creating or modifying a Request, Response, or other PSR-7 object alone is not sufficient. The issue requires the malformed message to be serialized and written to the network, forwarded, replayed, or otherwise processed by software that does not independently reject the malformed start line. This vulnerability is fixed in 2.12.1."
    },
    {
      "lang": "es",
      "value": "guzzlehttp/psr7 es una implementación de biblioteca de mensajes HTTP PSR-7 en PHP. Antes de la versión 2.12.1, guzzlehttp/psr7 no rechazaba los caracteres CR/LF en ciertos campos de línea de inicio HTTP de primera parte: el método de solicitud, la versión del protocolo y la frase de motivo de respuesta. Si una aplicación colocaba datos controlados por el atacante en uno de esos campos y luego serializaba el mensaje PSR-7 como HTTP/1.x sin procesar, por ejemplo, con Message::toString() o un serializador equivalente, el mensaje serializado podría contener líneas de encabezado controladas por el atacante. El problema también puede alcanzarse a través de Message::parseRequest() o Message::parseResponse() cuando los mensajes sin procesar malformados se analizan en objetos PSR-7 de primera parte y luego se serializan de nuevo. Crear o modificar un objeto Request, Response u otro objeto PSR-7 por sí solo no es suficiente. El problema requiere que el mensaje malformado sea serializado y escrito a la red, reenviado, reproducido o procesado de otra manera por software que no rechace de forma independiente la línea de inicio malformada. Esta vulnerabilidad está corregida en la versión 2.12.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "guzzle",
          "product": "psr7",
          "versions": [
            {
              "version": "< 2.12.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-23T15:49:11.244663Z",
          "id": "CVE-2026-55766",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-93"
        },
        {
          "lang": "en",
          "value": "CWE-113"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:guzzlephp:psr-7:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.12.1",
              "matchCriteriaId": "702482D2-3F8A-4A6D-97EC-4E21BB0C62EC"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/guzzle/psr7/security/advisories/GHSA-vm85-hxw5-5432",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}