CVE-2026-59882

Published: Jul 8, 2026Modified: Jul 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: NVD

Description

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3.

Affected (1)

Products: Guzzlephp: Psr 7

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Guzzlephp Psr 7	Before 2.12.3

Related CWEs

Interpretation Conflict

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

References (4)

https://github.com/guzzle/psr7/commit/ddd64f17d4cc1f7e5ffe6fd2c989ec7221712580

Source: security-advisories@github.com

Patch

https://github.com/guzzle/psr7/pull/811

Source: security-advisories@github.com

Issue TrackingPatch

https://github.com/guzzle/psr7/releases/tag/2.12.3

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/guzzle/psr7/security/advisories/GHSA-c2w2-prh8-qm98

Source: security-advisories@github.com

MitigationVendor Advisory

Timeline

No history available yet.