guzzlehttp/psr7 is vulnerable to Denial of Service
53
Medium Risk
The CachingStream decorator wraps remote streams so previously read bytes can be replayed after seeking. Forward seek() could spin indefinitely when the remote stream was not at EOF but returned no data on each read, consuming CPU on the worker handling that stream. On read(), a cache target that persisted only part of a write was previously ignored, which could silently corrupt later replays from the cache. The patch stops no-progress seek loops and throws when the cache buffer cannot store the full read.
You are affected if you are using a version that falls within the vulnerable range.
guzzlehttp/psr7 is vulnerable to Denial of Service in versions 2.0.0 - 2.10.3.
Upgrade the guzzlehttp/psr7 library to the patch version.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

SOC 2Compliant
ISO 27001Compliant