CVE-2026-59882

MEDIUM 4.2

guzzlehttp/psr7: Host Confusion via Weak URI Host Validation

CVSS Score

4.2

EPSS Score

0.0%

EPSS Percentile

0th

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3.

CWE	CWE-436
Vendor	guzzle
Product	psr7
Published	Jul 8, 2026
Last Updated	Jul 8, 2026

Stay Ahead of the Next One

Get instant alerts for guzzle psr7

Be the first to know when new medium vulnerabilities affecting guzzle psr7 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

guzzle / psr7

< 2.12.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/guzzle/psr7/security/advisories/GHSA-c2w2-prh8-qm98 github.com: https://github.com/guzzle/psr7/pull/811 github.com: https://github.com/guzzle/psr7/commit/ddd64f17d4cc1f7e5ffe6fd2c989ec7221712580 github.com: https://github.com/guzzle/psr7/releases/tag/2.12.3