What’s Vulnerable › Vulnerabilities

CVE-2026-59882: guzzlehttp/psr7: Host Confusion via Weak URI Host Validation

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-08 · updated 2026-10-25
• Weakness: CWE-436

Description

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3.

Affected products

• Guzzlephp Psr-7: before 2.12.3 — fixed in 2.12.3
• Packagist Guzzlehttp/Psr7: before 2.12.3; 1.0.0, 1.1.0, 1.2.0, 1.2.1, 1.2.2, 1.2.3 (+57) — fixed in 2.12.3

How to fix

Upgrade to a fixed version: Guzzlephp Psr-7 2.12.3; Packagist Guzzlehttp/Psr7 2.12.3. Check the vendor advisory for mitigations.

References

• https://github.com/guzzle/psr7/commit/ddd64f17d4cc1f7e5ffe6fd2c989ec7221712580
• https://github.com/guzzle/psr7/pull/811
• https://github.com/guzzle/psr7/releases/tag/2.12.3
• https://github.com/guzzle/psr7/security/advisories/GHSA-c2w2-prh8-qm98

Get alerted when CVE-2026-59882 or the next vulnerability affects your stack