guzzlehttp/psr7: CRLF injection via Host header in URI host components
guzzlehttp/psr7 did not reject ASCII control characters, whitespace, or DEL in first-party URI host components, allowing CRLF injection into serialized Host hea
O que mudou
guzzlehttp/psr7 did not reject ASCII control characters, whitespace, or DEL in first-party URI host components, allowing CRLF injection into serialized Host headers.
Quem isso afeta
Applications that manually serialize PSR-7 requests into raw HTTP/1.x messages, forward raw HTTP messages, or use custom transports, proxying, crawling, webhook delivery, or similar request-dispatch code without independently validating URI hosts.
O que fazer hoje
Atualize para a versão 2.10.2 ou superior. Se não for possível atualizar, valide e rejeite strings de URI não confiáveis contendo caracteres de controle ASCII, espaços em branco ou DEL antes de construir instâncias de Uri ou Request do PSR-7.