CVE-2026-48998: CWE-20: Improper Input Validation in guzzle psr7
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improper Host header validation when parsing raw HTTP request messages and when deriving a server request URI from server variables. An attacker can provide a malformed Host header containing URI authority delimiters, such as `trusted.example@evil.example`. When the Host value is used to construct a URI, the malformed value can be reinterpreted as URI userinfo and host. This can cause the PSR-7 request URI host to differ from the original Host header value. Applications are affected if they parse attacker-controlled raw HTTP requests with `GuzzleHttp\Psr7\Message::parseRequest()` or the legacy 1.x `GuzzleHttp\Psr7\parse_request()` function, or if they build server requests from attacker-controlled server variables, then rely on the resulting URI host for routing, allow-list checks, or forwarding decisions. In affected forwarding or gateway scenarios, this may cause requests or credentials to be sent to an unintended host. The issue is patched in `2.10.2`. `1.x` is end-of-life and will not receive a patch. Some workarounds are available. Validate the `Host` header as `uri-host [ ":" port ]` before calling `Message::parseRequest()` or legacy `parse_request()` on untrusted HTTP request data, or before deriving routing and forwarding decisions from a parsed request URI. Reject Host values containing userinfo, path, query, or fragment delimiters.
AI Analysis
Technical Summary
The vulnerability in guzzlehttp/psr7 (prior to 2.10.2) involves improper input validation of the Host header during raw HTTP request parsing and server request URI derivation. An attacker can supply a malformed Host header containing URI authority delimiters (e.g., userinfo@host) that causes the constructed URI host to differ from the original Host header value. This discrepancy can lead to incorrect routing or forwarding decisions, potentially causing requests or credentials to be sent to unintended hosts. The vulnerability is addressed in version 2.10.2. The legacy 1.x versions are no longer maintained and remain vulnerable. Mitigation includes validating the Host header format before parsing or using the parsed URI for security decisions.
Potential Impact
The vulnerability allows an attacker to manipulate the Host header to cause the application to interpret the request URI host differently from the original Host header. This can lead to forwarding requests or credentials to unintended hosts, potentially enabling misrouting or unauthorized access scenarios. The impact is limited to confidentiality (partial information disclosure or misrouting) with no direct integrity or availability impact reported. Exploitation requires attacker-controlled raw HTTP requests or server variables.
Mitigation Recommendations
A fix is available in guzzlehttp/psr7 version 2.10.2. Users should upgrade to this version to remediate the vulnerability. For legacy 1.x versions, which are end-of-life and unpatched, apply workarounds by validating the Host header format as 'uri-host[:port]' before calling Message::parseRequest() or parse_request() on untrusted data. Reject Host headers containing userinfo, path, query, or fragment delimiters to prevent exploitation. Do not rely solely on the parsed URI host for routing or forwarding decisions without prior validation.
CVE-2026-48998: CWE-20: Improper Input Validation in guzzle psr7
Description
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improper Host header validation when parsing raw HTTP request messages and when deriving a server request URI from server variables. An attacker can provide a malformed Host header containing URI authority delimiters, such as `trusted.example@evil.example`. When the Host value is used to construct a URI, the malformed value can be reinterpreted as URI userinfo and host. This can cause the PSR-7 request URI host to differ from the original Host header value. Applications are affected if they parse attacker-controlled raw HTTP requests with `GuzzleHttp\Psr7\Message::parseRequest()` or the legacy 1.x `GuzzleHttp\Psr7\parse_request()` function, or if they build server requests from attacker-controlled server variables, then rely on the resulting URI host for routing, allow-list checks, or forwarding decisions. In affected forwarding or gateway scenarios, this may cause requests or credentials to be sent to an unintended host. The issue is patched in `2.10.2`. `1.x` is end-of-life and will not receive a patch. Some workarounds are available. Validate the `Host` header as `uri-host [ ":" port ]` before calling `Message::parseRequest()` or legacy `parse_request()` on untrusted HTTP request data, or before deriving routing and forwarding decisions from a parsed request URI. Reject Host values containing userinfo, path, query, or fragment delimiters.
CVSS v3.1
Score 5.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in guzzlehttp/psr7 (prior to 2.10.2) involves improper input validation of the Host header during raw HTTP request parsing and server request URI derivation. An attacker can supply a malformed Host header containing URI authority delimiters (e.g., userinfo@host) that causes the constructed URI host to differ from the original Host header value. This discrepancy can lead to incorrect routing or forwarding decisions, potentially causing requests or credentials to be sent to unintended hosts. The vulnerability is addressed in version 2.10.2. The legacy 1.x versions are no longer maintained and remain vulnerable. Mitigation includes validating the Host header format before parsing or using the parsed URI for security decisions.
Potential Impact
The vulnerability allows an attacker to manipulate the Host header to cause the application to interpret the request URI host differently from the original Host header. This can lead to forwarding requests or credentials to unintended hosts, potentially enabling misrouting or unauthorized access scenarios. The impact is limited to confidentiality (partial information disclosure or misrouting) with no direct integrity or availability impact reported. Exploitation requires attacker-controlled raw HTTP requests or server variables.
Mitigation Recommendations
A fix is available in guzzlehttp/psr7 version 2.10.2. Users should upgrade to this version to remediate the vulnerability. For legacy 1.x versions, which are end-of-life and unpatched, apply workarounds by validating the Host header format as 'uri-host[:port]' before calling Message::parseRequest() or parse_request() on untrusted data. Reject Host headers containing userinfo, path, query, or fragment delimiters to prevent exploitation. Do not rely solely on the parsed URI host for routing or forwarding decisions without prior validation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-26T23:26:07.976Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a2aaf9a57b0f63cf3a75356
Added to database: 6/11/2026, 12:52:42 PM
Last enriched: 6/11/2026, 1:07:35 PM
Last updated: 6/11/2026, 1:16:31 PM
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.