Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

guzzle/psr7

              2.12 @ 7ec62dc
            

Fixes

CVEs

HIGH

Peak severity

33.3%

Coverage

Highlights

HTTP Request Smuggling: 2 prior fixes. Scrutinize any change in this area.

src/Message.php: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

HTTP Request Smuggling: Inadequate validation of URI host components allowed control characters and whitespace to bypass structural checks, enabling attackers to inject arbitrary headers or split responses when utilizing generated URIs. Developers must strictly enforce host character safelists.

HTTP Request Smuggling: Improper validation of malformed Host headers containing authority delimiters allowed routing bypasses and mismatched URI host parsing. Robust canonicalization of authority prefixes and strict Host header validation are necessary to maintain request routing integrity.

CRLF Injection: Failure to reject carriage return (CR) and line feed (LF) characters in start-line elements (such as methods, protocol versions, or reason phrases) permitted injection of arbitrary HTTP header lines upon serialization. All start-line inputs must be validated against CRLF characters.