DEBIAN-CVE-2026-55766
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7 did not reject CR/LF characters in certain first-party HTTP start-line fields: the request method, protocol version, and response reason phrase. If an application placed attacker-controlled data into one of those fields and later serialized the PSR-7 message as raw HTTP/1.x, for example with Message::toString() or an equivalent serializer, the serialized message could contain attacker-controlled header lines. The issue can also be reached through Message::parseRequest() or Message::parseResponse() when malformed raw messages are parsed into first-party PSR-7 objects and then serialized again. Creating or modifying a Request, Response, or other PSR-7 object alone is not sufficient. The issue requires the malformed message to be serialized and written to the network, forwarded, replayed, or otherwise processed by software that does not independently reject the malformed start line. This vulnerability is fixed in 2.12.1.
DEBIAN-CVE-2026-55766
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-55766
php-guzzlehttp-psr7
Source reference: /affected/0/package/name
- Affected versions
- 2.10.3-1
Source reference:
/affected/0/versions2.10.4-1Source reference:
/affected/0/versions2.11.0-1Source reference:
/affected/0/versions2.12.0-1Source reference:
/affected/0/versions2.12.1-1Source reference:
/affected/0/versions2.12.3-1Source reference:
/affected/0/versions2.12.4-1Source reference:
/affected/0/versions2.12.5-1Source reference:
/affected/0/versions2.13.0-1Source reference:
/affected/0/versions2.13.1-1Source reference:
/affected/0/versions2.4.5-1Source reference:
/affected/0/versions2.4.5-1+deb12u1Source reference:
/affected/0/versions2.5.0-1Source reference:
/affected/0/versions2.6.0-1Source reference:
/affected/0/versions2.6.1-1Source reference:
/affected/0/versions2.6.2-1Source reference:
/affected/0/versions2.6.2-2Source reference:
/affected/0/versions2.6.2-3Source reference:
/affected/0/versions2.7.0-1Source reference:
/affected/0/versions2.7.0-2Source reference:
/affected/0/versions2.7.0-3Source reference:
/affected/0/versions2.7.1-1Source reference:
/affected/0/versions2.8.0-1Source reference:
/affected/0/versions2.8.0-2Source reference:
/affected/0/versions2.9.0-1Source reference:
/affected/0/versions2.9.0-2Source reference:
/affected/0/versions3.0.0-1Source reference:
/affected/0/versions3.1.0-1Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
php-guzzlehttp-psr7
Source reference: /affected/1/package/name
- Affected versions
- 2.7.1-1
Source reference:
/affected/1/versions2.7.1-1+deb13u1Source reference:
/affected/1/versions - Fixed versions
- 2.7.1-1+deb13u2
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
php-guzzlehttp-psr7
Source reference: /affected/2/package/name
- Affected versions
- 2.10.3-1
Source reference:
/affected/2/versions2.10.4-1Source reference:
/affected/2/versions2.11.0-1Source reference:
/affected/2/versions2.12.0-1Source reference:
/affected/2/versions2.7.1-1Source reference:
/affected/2/versions2.8.0-1Source reference:
/affected/2/versions2.8.0-2Source reference:
/affected/2/versions2.9.0-1Source reference:
/affected/2/versions2.9.0-2Source reference:
/affected/2/versions - Fixed versions
- 2.12.1-1
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "php-guzzlehttp-psr7",
"purl": "pkg:deb/debian/php-guzzlehttp-psr7?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"2.10.3-1",
"2.10.4-1",
"2.11.0-1",
"2.12.0-1",
"2.12.1-1",
"2.12.3-1",
"2.12.4-1",
"2.12.5-1",
"2.13.0-1",
"2.13.1-1",
"2.4.5-1",
"2.4.5-1+deb12u1",
"2.5.0-1",
"2.6.0-1",
"2.6.1-1",
"2.6.2-1",
"2.6.2-2",
"2.6.2-3",
"2.7.0-1",
"2.7.0-2",
"2.7.0-3",
"2.7.1-1",
"2.8.0-1",
"2.8.0-2",
"2.9.0-1",
"2.9.0-2",
"3.0.0-1",
"3.1.0-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-55766.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.1-1+deb13u2"
}
]
}
],
"package": {
"name": "php-guzzlehttp-psr7",
"purl": "pkg:deb/debian/php-guzzlehttp-psr7?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"2.7.1-1",
"2.7.1-1+deb13u1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-55766.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.12.1-1"
}
]
}
],
"package": {
"name": "php-guzzlehttp-psr7",
"purl": "pkg:deb/debian/php-guzzlehttp-psr7?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"2.10.3-1",
"2.10.4-1",
"2.11.0-1",
"2.12.0-1",
"2.7.1-1",
"2.8.0-1",
"2.8.0-2",
"2.9.0-1",
"2.9.0-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-55766.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #57874 · Revision 1
- Added to Heist Feed
- Publisher date