CVE-2026-48998

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48998", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-26T23:26:07.976Z", "datePublished": "2026-06-11T12:34:32.397Z", "dateUpdated": "2026-06-11T16:05:56.424Z"}, "containers": {"cna": {"title": "guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/guzzle/psr7/security/advisories/GHSA-34xg-wgjx-8xph", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/guzzle/psr7/security/advisories/GHSA-34xg-wgjx-8xph"}], "affected": [{"vendor": "guzzle", "product": "psr7", "versions": [{"version": "< 2.10.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-11T12:34:32.397Z"}, "descriptions": [{"lang": "en", "value": "guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improper Host header validation when parsing raw HTTP request messages and when deriving a server request URI from server variables. An attacker can provide a malformed Host header containing URI authority delimiters, such as `trusted.example@evil.example`. When the Host value is used to construct a URI, the malformed value can be reinterpreted as URI userinfo and host. This can cause the PSR-7 request URI host to differ from the original Host header value. Applications are affected if they parse attacker-controlled raw HTTP requests with `GuzzleHttp\\Psr7\\Message::parseRequest()` or the legacy 1.x `GuzzleHttp\\Psr7\\parse_request()` function, or if they build server requests from attacker-controlled server variables, then rely on the resulting URI host for routing, allow-list checks, or forwarding decisions. In affected forwarding or gateway scenarios, this may cause requests or credentials to be sent to an unintended host. The issue is patched in `2.10.2`. `1.x` is end-of-life and will not receive a patch. Some workarounds are available. Validate the `Host` header as `uri-host [ \":\" port ]` before calling `Message::parseRequest()` or legacy `parse_request()` on untrusted HTTP request data, or before deriving routing and forwarding decisions from a parsed request URI. Reject Host values containing userinfo, path, query, or fragment delimiters."}], "source": {"advisory": "GHSA-34xg-wgjx-8xph", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-11T16:05:39.189615Z", "id": "CVE-2026-48998", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T16:05:56.424Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48998", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-11T16:05:39.189615Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T16:05:52.519Z"}}], "cna": {"title": "guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation", "source": {"advisory": "GHSA-34xg-wgjx-8xph", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "guzzle", "product": "psr7", "versions": [{"status": "affected", "version": "< 2.10.2"}]}], "references": [{"url": "https://github.com/guzzle/psr7/security/advisories/GHSA-34xg-wgjx-8xph", "name": "https://github.com/guzzle/psr7/security/advisories/GHSA-34xg-wgjx-8xph", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improper Host header validation when parsing raw HTTP request messages and when deriving a server request URI from server variables. An attacker can provide a malformed Host header containing URI authority delimiters, such as `trusted.example@evil.example`. When the Host value is used to construct a URI, the malformed value can be reinterpreted as URI userinfo and host. This can cause the PSR-7 request URI host to differ from the original Host header value. Applications are affected if they parse attacker-controlled raw HTTP requests with `GuzzleHttp\\Psr7\\Message::parseRequest()` or the legacy 1.x `GuzzleHttp\\Psr7\\parse_request()` function, or if they build server requests from attacker-controlled server variables, then rely on the resulting URI host for routing, allow-list checks, or forwarding decisions. In affected forwarding or gateway scenarios, this may cause requests or credentials to be sent to an unintended host. The issue is patched in `2.10.2`. `1.x` is end-of-life and will not receive a patch. Some workarounds are available. Validate the `Host` header as `uri-host [ \":\" port ]` before calling `Message::parseRequest()` or legacy `parse_request()` on untrusted HTTP request data, or before deriving routing and forwarding decisions from a parsed request URI. Reject Host values containing userinfo, path, query, or fragment delimiters."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-11T12:34:32.397Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48998", "state": "PUBLISHED", "dateUpdated": "2026-06-11T16:05:56.424Z", "dateReserved": "2026-05-26T23:26:07.976Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-11T12:34:32.397Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "psr7", "vendor": "guzzle", "versions": [{"status": "affected", "version": "< 2.10.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:guzzlephp:psr-7:*:*:*:*:*:*:*:*", "matchCriteriaId": "5190DD04-7580-4B6E-BA5A-6B89E0A95A05", "versionEndExcluding": "2.10.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improper Host header validation when parsing raw HTTP request messages and when deriving a server request URI from server variables. An attacker can provide a malformed Host header containing URI authority delimiters, such as `trusted.example@evil.example`. When the Host value is used to construct a URI, the malformed value can be reinterpreted as URI userinfo and host. This can cause the PSR-7 request URI host to differ from the original Host header value. Applications are affected if they parse attacker-controlled raw HTTP requests with `GuzzleHttp\\Psr7\\Message::parseRequest()` or the legacy 1.x `GuzzleHttp\\Psr7\\parse_request()` function, or if they build server requests from attacker-controlled server variables, then rely on the resulting URI host for routing, allow-list checks, or forwarding decisions. In affected forwarding or gateway scenarios, this may cause requests or credentials to be sent to an unintended host. The issue is patched in `2.10.2`. `1.x` is end-of-life and will not receive a patch. Some workarounds are available. Validate the `Host` header as `uri-host [ \":\" port ]` before calling `Message::parseRequest()` or legacy `parse_request()` on untrusted HTTP request data, or before deriving routing and forwarding decisions from a parsed request URI. Reject Host values containing userinfo, path, query, or fragment delimiters."}, {"lang": "es", "value": "guzzlehttp/psr7 es una implementaci\u00f3n de la biblioteca de mensajes HTTP PSR-7 en PHP. Las versiones anteriores a la 2.10.2 contienen una validaci\u00f3n incorrecta del encabezado Host al analizar mensajes de solicitud HTTP sin procesar y al derivar una URI de solicitud del servidor a partir de variables del servidor. Un atacante puede proporcionar un encabezado Host malformado que contenga delimitadores de autoridad de URI, como \u2019trusted.example@evil.example\u2019. Cuando el valor de Host se utiliza para construir una URI, el valor malformado puede ser reinterpretado como informaci\u00f3n de usuario y host de la URI. Esto puede hacer que el host de la URI de solicitud PSR-7 difiera del valor original del encabezado Host. Las aplicaciones se ven afectadas si analizan solicitudes HTTP sin procesar controladas por un atacante con \u2019GuzzleHttp\\Psr7\\Message::parseRequest()\u2019 o la funci\u00f3n heredada 1.x \u2019GuzzleHttp\\Psr7\\parse_request()\u2019, o si construyen solicitudes de servidor a partir de variables de servidor controladas por un atacante, y luego dependen del host de la URI resultante para el enrutamiento, las comprobaciones de lista de permitidos o las decisiones de reenv\u00edo. En escenarios de reenv\u00edo o de pasarela afectados, esto puede hacer que las solicitudes o credenciales se env\u00eden a un host no deseado. El problema est\u00e1 parcheado en \u20192.10.2\u2019. \u20191.x\u2019 ha llegado al fin de su vida \u00fatil y no recibir\u00e1 un parche. Algunas soluciones alternativas est\u00e1n disponibles. Valide el encabezado \u2019Host\u2019 como \u2019uri-host [ \u2019:\u2019 puerto ]\u2019 antes de llamar a \u2019Message::parseRequest()\u2019 o a la funci\u00f3n heredada \u2019parse_request()\u2019 en datos de solicitud HTTP no confiables, o antes de derivar decisiones de enrutamiento y reenv\u00edo de una URI de solicitud analizada. Rechace los valores de Host que contengan delimitadores de informaci\u00f3n de usuario, ruta, consulta o fragmento."}], "id": "CVE-2026-48998", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48998", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-11T16:05:39.189615Z", "version": "2.0.3"}}]}, "published": "2026-06-11T13:16:33.133", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/guzzle/psr7/security/advisories/GHSA-34xg-wgjx-8xph"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-918"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "guzzlehttp/psr7: guzzlehttp/psr7: Information disclosure via improper Host header validation", "id": "2487891", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487891"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-1286", "details": ["guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improper Host header validation when parsing raw HTTP request messages and when deriving a server request URI from server variables. An attacker can provide a malformed Host header containing URI authority delimiters, such as `trusted.example@evil.example`. When the Host value is used to construct a URI, the malformed value can be reinterpreted as URI userinfo and host. This can cause the PSR-7 request URI host to differ from the original Host header value. Applications are affected if they parse attacker-controlled raw HTTP requests with `GuzzleHttp\\Psr7\\Message::parseRequest()` or the legacy 1.x `GuzzleHttp\\Psr7\\parse_request()` function, or if they build server requests from attacker-controlled server variables, then rely on the resulting URI host for routing, allow-list checks, or forwarding decisions. In affected forwarding or gateway scenarios, this may cause requests or credentials to be sent to an unintended host. The issue is patched in `2.10.2`. `1.x` is end-of-life and will not receive a patch. Some workarounds are available. Validate the `Host` header as `uri-host [ \":\" port ]` before calling `Message::parseRequest()` or legacy `parse_request()` on untrusted HTTP request data, or before deriving routing and forwarding decisions from a parsed request URI. Reject Host values containing userinfo, path, query, or fragment delimiters.", "A flaw was found in guzzlehttp/psr7, a PHP library for HTTP messages. A remote attacker could exploit improper validation of the Host header. By providing a specially crafted Host header, an attacker could cause the system to misinterpret the intended destination. This could lead to requests or credentials being sent to an unintended host, resulting in information disclosure in certain forwarding or gateway configurations."], "name": "CVE-2026-48998", "public_date": "2026-06-11T12:34:32Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-48998\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48998\nhttps://github.com/guzzle/psr7/security/advisories/GHSA-34xg-wgjx-8xph"], "statement": "This Moderate flaw in `guzzlehttp/psr7` allows a remote attacker to provide a malformed Host header, leading to misinterpretation of the intended destination. This can result in information disclosure, particularly in forwarding or gateway configurations where applications rely on the parsed URI host for routing or security decisions and process untrusted HTTP requests.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.10.2)"}}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "matching"}]}, "original": {"product": "psr7", "source": "cna", "vendor": "guzzle"}, "product": "psr-7", "vendor": "guzzlephp"}], "created": "2026-06-11T19:27:49.719984+00:00", "updated": "2026-06-13T02:00:08.402447+00:00", "vendors": ["guzzlephp", "guzzlephp$PRODUCT$psr-7"], "weaknesses": ["CWE-1286", "CWE-20", "CWE-918"]}