guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7 did not reject CR/LF characters in certain first-party HTTP start-line fields: the request method, protocol version, and response reason phrase. If an application placed attacker-controlled data into one of those fields and later serialized the PSR-7 message as raw HTTP/1.x, for example with Message::toString() or an equivalent serializer, the serialized message could contain attacker-controlled header lines. The issue can also be reached through Message::parseRequest() or Message::parseResponse() when malformed raw messages are parsed into first-party PSR-7 objects and then serialized again. Creating or modifying a Request, Response, or other PSR-7 object alone is not sufficient. The issue requires the malformed message to be serialized and written to the network, forwarded, replayed, or otherwise processed by software that does not independently reject the malformed start line. This vulnerability is fixed in 2.12.1.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ee50c21f92 advisory.

    33.0.6 Release

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5afe6630dc advisory.

    33.0.6 Release

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7     did not reject CR/LF characters in certain first-party HTTP start-line fields: the request method,     protocol version, and response reason phrase. If an application placed attacker-controlled data into one     of those fields and later serialized the PSR-7 message as raw HTTP/1.x, for example with     Message::toString() or an equivalent serializer, the serialized message could contain attacker-controlled     header lines. The issue can also be reached through Message::parseRequest() or Message::parseResponse()     when malformed raw messages are parsed into first-party PSR-7 objects and then serialized again. Creating     or modifying a Request, Response, or other PSR-7 object alone is not sufficient. The issue requires the     malformed message to be serialized and written to the network, forwarded, replayed, or otherwise processed     by software that does not independently reject the malformed start line. This vulnerability is fixed in     2.12.1. (CVE-2026-55766)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7
    did not reject CR/LF characters in certain first-party HTTP start-line fields: the request method,
    protocol version, and response reason phrase. If an application placed attacker-controlled data into one
    of those fields and later serialized the PSR-7 message as raw HTTP/1.x, for example with
    Message::toString() or an equivalent serializer, the serialized message could contain attacker-controlled
    header lines. The issue can also be reached through Message::parseRequest() or Message::parseResponse()
    when malformed raw messages are parsed into first-party PSR-7 objects and then serialized again. Creating
    or modifying a Request, Response, or other PSR-7 object alone is not sufficient. The issue requires the
    malformed message to be serialized and written to the network, forwarded, replayed, or otherwise processed
    by software that does not independently reject the malformed start line. This vulnerability is fixed in
    2.12.1. (CVE-2026-55766)

ID	Name	Product	Family	Severity
325136	Fedora 44 : nextcloud (2026-ee50c21f92)	Nessus	Fedora Local Security Checks	high
325111	Fedora 43 : nextcloud (2026-5afe6630dc)	Nessus	Fedora Local Security Checks	high
321774	Linux Distros Unpatched Vulnerability : CVE-2026-55766	Nessus	Misc.	medium
443586	SCA: security update for guzzlehttp/psr7 (GHSA-vm85-hxw5-5432)	Tenable Cloud Security	SCA Checks	medium
443586	SCA: security update for guzzlehttp/psr7 (GHSA-vm85-hxw5-5432)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-55766

medium

Tenable Plugins

high

high

medium

medium

medium