{"id":"GHSA-9jxr-mwpp-w643","aliases":[],"title":"Improper header validation in httpsoft/http-message","description":"### Impact\n\nImproper header parsing. An attacker could sneak in a newline (`\\n`) into both the header names and values. While the specification states that `\\r\\n\\r\\n` is used to terminate the header list, many servers in the wild will also accept `\\n\\n`.\n\n### Patches\n\nThe issue is patched in 1.0.12.\n\n### Workarounds\n\nThere are no known workarounds.\n\n### References\n\n* https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4","severity":"medium","score":5.3,"published":"2023-04-21T20:27:12.000Z","modified":"2024-12-06T05:39:27.356Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"httpsoft/http-message","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.0.12"}],"type":"ECOSYSTEM"}],"versions":["1.0.0","1.0.1","1.0.10","1.0.11","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9"],"fixed":["1.0.12"]}],"references":["https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw","https://github.com/httpsoft/http-message/security/advisories/GHSA-9jxr-mwpp-w643","https://nvd.nist.gov/vuln/detail/CVE-2023-29197","https://github.com/httpsoft/http-message"],"sources":[{"name":"OSV","id":"GHSA-9jxr-mwpp-w643","modified":"2024-12-06T05:39:27.356128Z","url":"https://osv.dev/vulnerability/GHSA-9jxr-mwpp-w643"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3}]}