What’s Vulnerable › Vulnerabilities
CVE-2026-48998: guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-11 · updated 2026-10-26
- Weakness: CWE-20
Description
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improper Host header validation when parsing raw HTTP request messages and when deriving a server request URI from server variables. An attacker can provide a malformed Host header containing URI authority delimiters, such as `trusted.example@evil.example`. When the Host value is used to construct a URI, the malformed value can be reinterpreted as URI userinfo and host. This can cause the PSR-7 request URI host to differ from the original Host header value. Applications are affected if they parse attacker-controlled raw HTTP requests with `GuzzleHttp\Psr7\Message::parseRequest()` or the legacy 1.x `GuzzleHttp\Psr7\parse_request()` function, or if they build server requests from attacker-controlled server variables, then rely on the resulting URI host for routing, allow-list checks, or forwarding decisions. In affected forwarding or gateway scenarios, this may cause requests or credentials to be sent to an unintended host. The issue is patched in `2.10.2`. `1.x` is end-of-life and will not receive a patch. Some workarounds are available. Validate the `Host` header as `uri-host [ ":" port ]` before calling `Message::parseRequest()` or legacy `parse_request()` on untrusted HTTP request data, or before deriving routing and forwarding decisions from a parsed request URI. Reject Host values containing userinfo, path, query, or fragment delimiters.
Affected products
- Guzzlephp Psr-7: before 2.10.2 — fixed in 2.10.2
- Packagist Guzzlehttp/Psr7: before 2.10.2; 1.0.0, 1.1.0, 1.2.0, 1.2.1, 1.2.2, 1.2.3 (+49) — fixed in 2.10.2
How to fix
Upgrade to a fixed version: Guzzlephp Psr-7 2.10.2; Packagist Guzzlehttp/Psr7 2.10.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-48998 or the next vulnerability affects your stack