The guzzlehttp/psr7 PHP library versions before 2.10.2 do not properly reject ASCII control characters, whitespace, or DEL characters in the host component of URIs. When an application uses a user-controlled URL to create a PSR-7 Uri or Request, the host component may include CRLF or other header-unsafe characters. This causes the Host header to span multiple lines, enabling injection of attacker-controlled HTTP headers. This vulnerability affects flows such as outbound HTTP requests, URL forwarding, proxying, crawling, and webhook delivery. It may contribute to HTTP request smuggling or cache poisoning depending on downstream parsing. The issue is fixed in version 2.10.2. Version 1.x is end-of-life and unpatched. Workarounds include validating and rejecting untrusted URIs containing control characters before use and ensuring HTTP clients reject invalid headers.

This vulnerability allows an attacker controlling a URL to inject additional HTTP headers into outbound requests by exploiting improper input validation in the URI host component. This can lead to HTTP header injection, potentially enabling request smuggling or cache poisoning in environments with HTTP/1.1 connection reuse, proxies, gateways, or load balancers. The impact is limited to integrity of HTTP requests sent by affected applications and does not directly affect confidentiality or availability.

A fix is available in guzzlehttp/psr7 version 2.10.2 and later; upgrading to this version or newer fully mitigates the vulnerability. For applications unable to upgrade immediately, validate and reject all untrusted URI strings containing ASCII control characters, whitespace, or DEL characters before constructing PSR-7 Uri or Request instances. Additionally, ensure that the final HTTP client or serializer rejects invalid URI and header data before sending requests to the network.