CVE-2026-59882
published 2026-07-08CVE-2026-59882: guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing…
PriorityP336medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
0.32%
23.5th percentile
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| guzzle | psr7 | < 2.12.3 | 2.12.3 |
| guzzlehttp | psr7 | >= 0 < 2.12.3 | 2.12.3 |
| guzzlephp | psr-7 | < 2.12.3 | 2.12.3 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
guzzlehttp/psr7: Host Confusion via Weak URI Host Validation
ghsa·2026-07-21
CVE-2026-59882 [MEDIUM] CWE-20 guzzlehttp/psr7: Host Confusion via Weak URI Host Validation
guzzlehttp/psr7: Host Confusion via Weak URI Host Validation
### Impact
`guzzlehttp/psr7` did not reject URI host components containing authority delimiters (`/`, `?`, `#`, `@`, or `\`), an embedded port such as `host:8080`, or IPv6 brackets that do not frame the host (such as `[::1` or `::1]`). `Uri::assertValidHost()` rejected only control characters, so these malformed hosts were accepted both when parsing a URI string — including through `new Uri()`, an absolute-form request target passed to `Message::parseRequest()`, and the synthetic `SERVER_NAME` or `SERVER_ADDR` fallback used by `ServerRequest::fromGlobals()` — and when setting a host with `Uri::withHost()`. Because the stored host was not validated, `Uri::getHost()` could return a value that does not agree with the URI's authori
VulDB
guzzle psr7 up to 2.12.2 Host Validator getHost assertion (Nessus ID 325842)
vuldb·2026-07-13·CVSS 4.2
CVE-2026-59882 [MEDIUM] guzzle psr7 up to 2.12.2 Host Validator getHost assertion (Nessus ID 325842)
A vulnerability was found in guzzle psr7 up to 2.12.2. It has been rated as critical. Affected by this vulnerability is the function Uri::assertValidHost/Uri::getHost of the component Host Validator. This manipulation causes reachable assertion.
This vulnerability is registered as CVE-2026-59882. Remote exploitation of the attack is possible. No exploit is available.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59882 nextcloud: guzzlehttp/psr7: URI host validation flaw can lead to security bypass or misrouting [fedora-all]
bugzilla·2026-07-10·CVSS 4.2
CVE-2026-59882 [MEDIUM] CVE-2026-59882 nextcloud: guzzlehttp/psr7: URI host validation flaw can lead to security bypass or misrouting [fedora-all]
CVE-2026-59882 nextcloud: guzzlehttp/psr7: URI host validation flaw can lead to security bypass or misrouting [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3.
Bugzilla
CVE-2026-59882 nextcloud: guzzlehttp/psr7: URI host validation flaw can lead to security bypass or misrouting [epel-all]
bugzilla·2026-07-10·CVSS 4.2
CVE-2026-59882 [MEDIUM] CVE-2026-59882 nextcloud: guzzlehttp/psr7: URI host validation flaw can lead to security bypass or misrouting [epel-all]
CVE-2026-59882 nextcloud: guzzlehttp/psr7: URI host validation flaw can lead to security bypass or misrouting [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3.
Bugzilla
CVE-2026-59882 roundcubemail: guzzlehttp/psr7: URI host validation flaw can lead to security bypass or misrouting [epel-all]
bugzilla·2026-07-10·CVSS 4.2
CVE-2026-59882 [MEDIUM] CVE-2026-59882 roundcubemail: guzzlehttp/psr7: URI host validation flaw can lead to security bypass or misrouting [epel-all]
CVE-2026-59882 roundcubemail: guzzlehttp/psr7: URI host validation flaw can lead to security bypass or misrouting [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3.
Bugzilla
CVE-2026-59882 roundcubemail: guzzlehttp/psr7: URI host validation flaw can lead to security bypass or misrouting [fedora-all]
bugzilla·2026-07-10·CVSS 4.2
CVE-2026-59882 [MEDIUM] CVE-2026-59882 roundcubemail: guzzlehttp/psr7: URI host validation flaw can lead to security bypass or misrouting [fedora-all]
CVE-2026-59882 roundcubemail: guzzlehttp/psr7: URI host validation flaw can lead to security bypass or misrouting [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3.
Bugzilla
CVE-2026-59882 guzzlehttp/psr7: guzzlehttp/psr7: URI host validation flaw can lead to security bypass or misrouting
bugzilla·2026-07-08·CVSS 4.2
CVE-2026-59882 [MEDIUM] CVE-2026-59882 guzzlehttp/psr7: guzzlehttp/psr7: URI host validation flaw can lead to security bypass or misrouting
CVE-2026-59882 guzzlehttp/psr7: guzzlehttp/psr7: URI host validation flaw can lead to security bypass or misrouting
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3.
2026-07-08
Published