[MEDIUM] CRLF injection in HTTP start-line serialization

PKSA-7qs6-zvnz-h66r CVE-2026-55766 GHSA-vm85-hxw5-5432

Affected version: <2.12.1

Reported by:
GitHub, FriendsOfPHP/security-advisories