Skip to content
Fencer Vulns
medium 6.5

CVE-2023-30536 json

Insecure header validation in slim/psr7

published 2023-04-17 3 y ago modified 2026-09-10 1 mo ago also GHSA-q2qj-628g-vhfw , EUVD-2023-1372

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits
0
none known

Summary

slim/psr7 is a PSR-7 implementation for use with Slim 4. In versions prior to 1.6.1 an attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. An attacker that is able to control the header names that are passed to Slilm-Psr7 would be able to intentionally craft invalid messages, possibly causing application errors or invalid HTTP requests being sent out with an PSR-18 HTTP client. The latter might present a denial of service vector if a remote service’s web application firewall bans the application due to the receipt of malformed requests. The issue has been patched in version 1.6.1. There are no known workarounds to this issue. Users are advised to upgrade.

Patch / fix

  • packagist slim/psr7 1.4.1, 1.5.1, 1.6.1
  • slimframework slim_psr-7 1.6.1
  • php-slim-psr7 Debian 14, Debian 13, Debian 12 1.6.1-1

debian advisories DEBIAN-CVE-2023-30536

  • phpMyAdmin Package Hub 15 SP6, openSUSE Leap 15.6 5.2.2-bp156.4.3.1
  • phpMyAdmin openSUSE Tumbleweed 5.2.2-1.1

opensuse advisories openSUSE-SU-2025:0081-1openSUSE-SU-2025:14688-1

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
21 mo ago

Exploit prediction

0.74% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected packages

ecosystem package affected fixed in
packagist slim/psr7
>=1.6, <1.6.1
>=1.5, <1.5.1
<1.4.1
1.6.1
1.5.1
1.4.1

Affected products

  • slimphp Slim-Psr7

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.