composer

guzzlehttp/psr7

Security advisories for guzzlehttp/psr7, newest first. 6 known, all fixed. If you’re on 2.12.3 or later, none of them affect you.

RSS feed Check your lock file →

Latest version

3.2.0

Advisories

6 · 0 unfixed

Last advisory

21 Jul 2026

Safe from

2.12.3

6 advisories · newest first

MODERATE4.2 21 Jul 2026

guzzlehttp/psr7: Host Confusion via Weak URI Host Validation

GHSA-c2w2-prh8-qm98 · CVE-2026-59882

Affected

< 2.12.3

Fixed in

2.12.3

Published

21 Jul 2026

MODERATE4.8 18 Jun 2026

CRLF injection in HTTP start-line serialization

GHSA-vm85-hxw5-5432 · CVE-2026-55766

Affected

< 2.12.1

Fixed in

2.12.1

Published

18 Jun 2026

MODERATE5.3 25 May 2026

Host confusion via authority reinterpretation

GHSA-34xg-wgjx-8xph · CVE-2026-48998

Affected

< 2.10.2

Fixed in

2.10.2

Published

25 May 2026

MODERATE5.3 25 May 2026

CRLF injection via URI host component

GHSA-hq7v-mx3g-29hw · CVE-2026-49214

Affected

< 2.10.2

Fixed in

2.10.2

Published

25 May 2026

MODERATE5.3 17 Apr 2023

Improper header validation

GHSA-wxmh-65f7-jcvw · CVE-2023-29197

Affected

< 1.9.1 ≥ 2, < 2.4.5

Fixed in

1.9.1 2.4.5

Published

17 Apr 2023

MODERATE5.3 20 Mar 2022

Inproper parsing of HTTP headers

GHSA-q7rv-6hp3-vh96 · CVE-2022-24775

Affected

< 1.8.4 ≥ 2, < 2.1.1

Fixed in

1.8.4 2.1.1

Published

20 Mar 2022

/advisories/composer/guzzlehttp/psr7/feed.rss

From Packagist and the GitHub advisory database · synced hourly

Same vendor

guzzlehttp/guzzle15 advisories

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →