Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-48998— guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation

Quick assessment

Affected
guzzle psr7
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Guzzle是guzzlehttp个人开发者的一个 PHP HTTP 客户端，可以轻松发送 HTTP 请求并轻松与 Web 服务集成。 Guzzle 2.10.2之前版本存在输入验证错误漏洞，该漏洞源于Host标头验证不当，可能导致攻击者提供包含URI权限分隔符的恶意Host标头，导致URI主机与原始Host标头值不一致，影响路由、白名单检查或转发决策。

CVSS 5.3 · Medium EPSS 0.20% · P10

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
guzzle psr7 < 2.10.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-48998

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation
Source: CVE Program / CVE List V5
Vulnerability Description
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improper Host header validation when parsing raw HTTP request messages and when deriving a server request URI from server variables. An attacker can provide a malformed Host header containing URI authority delimiters, such as `trusted.example@evil.example`. When the Host value is used to construct a URI, the malformed value can be reinterpreted as URI userinfo and host. This can cause the PSR-7 request URI host to differ from the original Host header value. Applications are affected if they parse attacker-controlled raw HTTP requests with `GuzzleHttp\Psr7\Message::parseRequest()` or the legacy 1.x `GuzzleHttp\Psr7\parse_request()` function, or if they build server requests from attacker-controlled server variables, then rely on the resulting URI host for routing, allow-list checks, or forwarding decisions. In affected forwarding or gateway scenarios, this may cause requests or credentials to be sent to an unintended host. The issue is patched in `2.10.2`. `1.x` is end-of-life and will not receive a patch. Some workarounds are available. Validate the `Host` header as `uri-host [ ":" port ]` before calling `Message::parseRequest()` or legacy `parse_request()` on untrusted HTTP request data, or before deriving routing and forwarding decisions from a parsed request URI. Reject Host values containing userinfo, path, query, or fragment delimiters.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Guzzle 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Guzzle是guzzlehttp个人开发者的一个 PHP HTTP 客户端，可以轻松发送 HTTP 请求并轻松与 Web 服务集成。 Guzzle 2.10.2之前版本存在输入验证错误漏洞，该漏洞源于Host标头验证不当，可能导致攻击者提供包含URI权限分隔符的恶意Host标头，导致URI主机与原始Host标头值不一致，影响路由、白名单检查或转发决策。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
guzzle psr7 < 2.10.2 -

II. Public POCs for CVE-2026-48998

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-48998

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-48998 (1)

Same Patch Batch · guzzle · 2026-06-11 · 3 CVEs total

CVE-2026-53723 5.8 MEDIUM guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDAT
CVE-2026-49214 5.3 MEDIUM guzzlehttp/psr7 has CRLF Injection via URI Host Component

IV. Related Vulnerabilities

Same product: psr7
Same vendor: guzzle
Same weakness: CWE-20