CVE-2026-59882 MEDIUM

CVE-2026-59882: guzzlehttp/psr7: Host Confusion via Weak URI Host Validation

Vendor Guzzle
Product psr7
Weakness CWE-436
Published July 8, 2026
Last update July 8, 2026
View on NVD All CVEs

CVSS base score

4.2/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3.

Key dates

02Disclosure timeline

July 8, 2026 CVE published
July 8, 2026 Record updated