guzzlehttp/psr7 before 2.10.2 improperly validates the Host header during raw HTTP request parsing and server request URI derivation. Attackers can craft Host headers with URI authority delimiters (e.g., '[email protected]'), causing the constructed URI host to differ from the original Host header value. This discrepancy affects applications that parse attacker-controlled requests or server variables and rely on the URI host for routing, allow-list checks, or forwarding. The vulnerability can lead to requests or credentials being sent to unintended hosts in forwarding or gateway scenarios. The issue is fixed in version 2.10.2. Legacy 1.x versions are unpatched and end-of-life. Workarounds include validating the Host header format before parsing or routing decisions, rejecting Host values containing userinfo, path, query, or fragment delimiters.

The vulnerability allows an attacker to manipulate the Host header in a way that causes the application to interpret the request URI host differently from the original Host header. This can result in misrouting requests or forwarding credentials to unintended hosts, potentially leading to information disclosure or unauthorized request forwarding. The impact is limited to applications that parse untrusted raw HTTP requests or server variables using affected guzzlehttp/psr7 versions and rely on the URI host for security decisions.

A fix is available in guzzlehttp/psr7 version 2.10.2; upgrading to this version or later resolves the issue. For users of legacy 1.x versions, which are end-of-life and unpatched, apply workarounds by validating the Host header to ensure it matches the format 'uri-host[:port]' before parsing requests or making routing/forwarding decisions. Reject Host header values containing userinfo, path, query, or fragment delimiters to prevent exploitation.