CVE-2026-48998
guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation
Description
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improper Host header validation when parsing raw HTTP request messages and when deriving a server request URI from server variables. An attacker can provide a malformed Host header containing URI authority delimiters, such as `[email protected]`. When the Host value is used to construct a URI, the malformed value can be reinterpreted as URI userinfo and host. This can cause the PSR-7 request URI host to differ from the original Host header value. Applications are affected if they parse attacker-controlled raw HTTP requests with `GuzzleHttp\Psr7\Message::parseRequest()` or the legacy 1.x `GuzzleHttp\Psr7\parse_request()` function, or if they build server requests from attacker-controlled server variables, then rely on the resulting URI host for routing, allow-list checks, or forwarding decisions. In affected forwarding or gateway scenarios, this may cause requests or credentials to be sent to an unintended host. The issue is patched in `2.10.2`. `1.x` is end-of-life and will not receive a patch. Some workarounds are available. Validate the `Host` header as `uri-host [ ":" port ]` before calling `Message::parseRequest()` or legacy `parse_request()` on untrusted HTTP request data, or before deriving routing and forwarding decisions from a parsed request URI. Reject Host values containing userinfo, path, query, or fragment delimiters.
INFO
Published Date :
June 11, 2026, 1:16 p.m.
Last Modified :
Oct. 26, 2026, 11:10 a.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update guzzlehttp/psr7 to version 2.10.2 or later.
- Validate Host header for URI delimiters before parsing.
- Reject Host values with userinfo, path, query, or fragment delimiters.
Public PoC/Exploit Available at Github
CVE-2026-48998 has a 2 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-48998.
| URL | Resource |
|---|---|
| https://github.com/guzzle/psr7/security/advisories/GHSA-34xg-wgjx-8xph | Mitigation Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-48998 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-48998
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Demo project with vulnerabilities to test tools
PHP
None
Shell Python Dockerfile JavaScript CSS HTML Hack PHP Jinja Makefile
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-48998 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-48998 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 26, 2026
Action Type Old Value New Value Added Translation Title: psr7 de guzzle, Description: guzzlehttp/psr7 es una implementación de la biblioteca de mensajes HTTP PSR-7 en PHP. Las versiones anteriores a la 2.10.2 contienen una validación incorrecta del encabezado Host al analizar mensajes de solicitud HTTP sin procesar y al derivar una URI de solicitud del servidor a partir de variables del servidor. Un atacante puede proporcionar un encabezado Host malformado que contenga delimitadores de autoridad de URI, como ’[email protected]’. Cuando el valor de Host se utiliza para construir una URI, el valor malformado puede ser reinterpretado como información de usuario y host de la URI. Esto puede hacer que el host de la URI de solicitud PSR-7 difiera del valor original del encabezado Host. Las aplicaciones se ven afectadas si analizan solicitudes HTTP sin procesar controladas por un atacante con ’GuzzleHttp\Psr7\Message::parseRequest()’ o la función heredada 1.x ’GuzzleHttp\Psr7\parse_request()’, o si construyen solicitudes de servidor a partir de variables de servidor controladas por un atacante, y luego dependen del host de la URI resultante para el enrutamiento, las comprobaciones de lista de permitidos o las decisiones de reenvío. En escenarios de reenvío o de pasarela afectados, esto puede hacer que las solicitudes o credenciales se envíen a un host no deseado. El problema está parcheado en ’2.10.2’. ’1.x’ ha llegado al fin de su vida útil y no recibirá un parche. Algunas soluciones alternativas están disponibles. Valide el encabezado ’Host’ como ’uri-host [ ’:’ puerto ]’ antes de llamar a ’Message::parseRequest()’ o a la función heredada ’parse_request()’ en datos de solicitud HTTP no confiables, o antes de derivar decisiones de enrutamiento y reenvío de una URI de solicitud analizada. Rechace los valores de Host que contengan delimitadores de información de usuario, ruta, consulta o fragmento. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'guzzle', 'product': 'psr7', 'versions': [{'status': 'affected', 'version': '< 2.10.2'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-48998', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-11T16:05:39.189615Z'} -
Initial Analysis by [email protected]
Jun. 15, 2026
Action Type Old Value New Value Added CWE CWE-918 Added CPE Configuration OR *cpe:2.3:a:guzzlephp:psr-7:*:*:*:*:*:*:*:* versions up to (excluding) 2.10.2 Added Reference Type GitHub, Inc.: https://github.com/guzzle/psr7/security/advisories/GHSA-34xg-wgjx-8xph Types: Mitigation, Vendor Advisory -
New CVE Received by [email protected]
Jun. 11, 2026
Action Type Old Value New Value Added Description guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improper Host header validation when parsing raw HTTP request messages and when deriving a server request URI from server variables. An attacker can provide a malformed Host header containing URI authority delimiters, such as `[email protected]`. When the Host value is used to construct a URI, the malformed value can be reinterpreted as URI userinfo and host. This can cause the PSR-7 request URI host to differ from the original Host header value. Applications are affected if they parse attacker-controlled raw HTTP requests with `GuzzleHttp\Psr7\Message::parseRequest()` or the legacy 1.x `GuzzleHttp\Psr7\parse_request()` function, or if they build server requests from attacker-controlled server variables, then rely on the resulting URI host for routing, allow-list checks, or forwarding decisions. In affected forwarding or gateway scenarios, this may cause requests or credentials to be sent to an unintended host. The issue is patched in `2.10.2`. `1.x` is end-of-life and will not receive a patch. Some workarounds are available. Validate the `Host` header as `uri-host [ ":" port ]` before calling `Message::parseRequest()` or legacy `parse_request()` on untrusted HTTP request data, or before deriving routing and forwarding decisions from a parsed request URI. Reject Host values containing userinfo, path, query, or fragment delimiters. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Added CWE CWE-20 Added CWE CWE-918 Added Reference https://github.com/guzzle/psr7/security/advisories/GHSA-34xg-wgjx-8xph