CVE-2026-49214: CWE-20: Improper Input Validation in guzzle psr7
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 did not reject ASCII control characters, whitespace, or DEL in first-party URI host components. A vulnerable flow is: First, an application accepts a user-controlled URL. Second, the URL is used to construct a PSR-7 `Uri` or `Request`. Third, the host component contains CRLF or another header-unsafe character. Fourth, the host is copied into the PSR-7 `Host` header when no explicit `Host` header is provided. Finally, the request is serialized or sent by an HTTP client that does not independently reject the malformed host. In that flow, an attacker can cause the serialized request to contain additional attacker-controlled header lines. For example, a host containing `"\r\nX-Injected: yes"` can cause the generated `Host` header to span multiple HTTP header lines. Applications are affected when they use user-controlled URLs for outbound HTTP requests, URL forwarding, proxying, crawling, webhook delivery, or similar request-dispatch flows. In deployments involving HTTP/1.1 connection reuse, proxies, gateways, or load balancers, this malformed request may also contribute to request smuggling or cache poisoning, depending on how downstream components parse the request. The issue is patched in `2.10.2` and later. `1.x` is end-of-life and will not receive a patch. As a workaround, validate and reject all untrusted URI strings before constructing PSR-7 `Uri` or `Request` instances. Reject input containing ASCII control characters, whitespace, or DEL, including CRLF, tab, space, NUL, or DEL characters. Applications that forward requests should also ensure the final HTTP client or serializer rejects invalid URI and header data before writing requests to the network.
AI Analysis
Technical Summary
The guzzlehttp/psr7 PHP library versions before 2.10.2 do not properly reject ASCII control characters, whitespace, or DEL characters in the URI host component. This improper input validation can allow an attacker to inject CRLF or other header-unsafe characters into the host header, causing the serialized HTTP request to contain additional attacker-controlled headers. This vulnerability affects applications that use user-controlled URLs for outbound HTTP requests, such as URL forwarding, proxying, crawling, or webhook delivery. The malformed requests can contribute to HTTP request smuggling or cache poisoning depending on downstream parsing. The issue is patched in version 2.10.2. Version 1.x is end-of-life and unpatched. Workarounds include validating and rejecting untrusted URI strings containing control characters before constructing PSR-7 Uri or Request instances.
Potential Impact
Exploitation can lead to injection of additional HTTP headers in outbound requests, potentially enabling HTTP request smuggling or cache poisoning in environments with HTTP/1.1 connection reuse, proxies, gateways, or load balancers. The integrity of HTTP requests can be compromised, impacting request dispatch flows such as forwarding, proxying, or webhook delivery. There is no direct confidentiality or availability impact reported.
Mitigation Recommendations
A fix is available in guzzlehttp/psr7 version 2.10.2 and later; upgrading to this version or newer fully mitigates the vulnerability. Version 1.x is end-of-life and will not receive a patch. As a workaround, applications should validate and reject all untrusted URI strings containing ASCII control characters, whitespace, or DEL characters before constructing PSR-7 Uri or Request objects. Additionally, ensure that the HTTP client or serializer used rejects invalid URI and header data before sending requests to the network.
CVE-2026-49214: CWE-20: Improper Input Validation in guzzle psr7
Description
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 did not reject ASCII control characters, whitespace, or DEL in first-party URI host components. A vulnerable flow is: First, an application accepts a user-controlled URL. Second, the URL is used to construct a PSR-7 `Uri` or `Request`. Third, the host component contains CRLF or another header-unsafe character. Fourth, the host is copied into the PSR-7 `Host` header when no explicit `Host` header is provided. Finally, the request is serialized or sent by an HTTP client that does not independently reject the malformed host. In that flow, an attacker can cause the serialized request to contain additional attacker-controlled header lines. For example, a host containing `"\r\nX-Injected: yes"` can cause the generated `Host` header to span multiple HTTP header lines. Applications are affected when they use user-controlled URLs for outbound HTTP requests, URL forwarding, proxying, crawling, webhook delivery, or similar request-dispatch flows. In deployments involving HTTP/1.1 connection reuse, proxies, gateways, or load balancers, this malformed request may also contribute to request smuggling or cache poisoning, depending on how downstream components parse the request. The issue is patched in `2.10.2` and later. `1.x` is end-of-life and will not receive a patch. As a workaround, validate and reject all untrusted URI strings before constructing PSR-7 `Uri` or `Request` instances. Reject input containing ASCII control characters, whitespace, or DEL, including CRLF, tab, space, NUL, or DEL characters. Applications that forward requests should also ensure the final HTTP client or serializer rejects invalid URI and header data before writing requests to the network.
CVSS v3.1
Score 5.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The guzzlehttp/psr7 PHP library versions before 2.10.2 do not properly reject ASCII control characters, whitespace, or DEL characters in the URI host component. This improper input validation can allow an attacker to inject CRLF or other header-unsafe characters into the host header, causing the serialized HTTP request to contain additional attacker-controlled headers. This vulnerability affects applications that use user-controlled URLs for outbound HTTP requests, such as URL forwarding, proxying, crawling, or webhook delivery. The malformed requests can contribute to HTTP request smuggling or cache poisoning depending on downstream parsing. The issue is patched in version 2.10.2. Version 1.x is end-of-life and unpatched. Workarounds include validating and rejecting untrusted URI strings containing control characters before constructing PSR-7 Uri or Request instances.
Potential Impact
Exploitation can lead to injection of additional HTTP headers in outbound requests, potentially enabling HTTP request smuggling or cache poisoning in environments with HTTP/1.1 connection reuse, proxies, gateways, or load balancers. The integrity of HTTP requests can be compromised, impacting request dispatch flows such as forwarding, proxying, or webhook delivery. There is no direct confidentiality or availability impact reported.
Mitigation Recommendations
A fix is available in guzzlehttp/psr7 version 2.10.2 and later; upgrading to this version or newer fully mitigates the vulnerability. Version 1.x is end-of-life and will not receive a patch. As a workaround, applications should validate and reject all untrusted URI strings containing ASCII control characters, whitespace, or DEL characters before constructing PSR-7 Uri or Request objects. Additionally, ensure that the HTTP client or serializer used rejects invalid URI and header data before sending requests to the network.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-28T03:42:34.341Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a2aaf9a57b0f63cf3a75359
Added to database: 6/11/2026, 12:52:42 PM
Last enriched: 6/11/2026, 1:07:29 PM
Last updated: 6/11/2026, 1:15:59 PM
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.