CRLF injection in PSR-7 - CVE-2026-55766
Published: June 18, 2026
Vulnerability identifier: #VU134879
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-55766
CWE-ID: CWE-93
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to inject arbitrary HTTP header lines.
The vulnerability exists due to improper neutralization of CRLF sequences in HTTP start-line fields when serializing PSR-7 messages as raw HTTP/1.x. A remote attacker can supply crafted method, protocol version, or reason phrase values to inject arbitrary HTTP header lines.
Exploitation requires attacker-controlled data to be placed into the request method, protocol version, or response reason phrase and for the malformed message to be serialized and processed by downstream software that does not independently reject the malformed start line.
Affected software
PSR-7
How to mitigate CVE-2026-55766
Install security update from vendor's website.
PSR-7 - update to 2.12.1