By vendor

Guzzlephp vulnerabilities

Known CVEs affecting Guzzlephp products, prioritized by severity, with SEC.co remediation and detection guidance.

2 published vulnerabilities

• CVE-2026-48998MEDIUM 5.3

  A library used by PHP developers to handle HTTP messages (guzzlehttp/psr7) has a flaw in how it validates the Host header when processing HTTP requests. An attacker can craft a malicious Host header that tricks the library into misidentifying which server the request is intended for. For example, an attacker could use a Host header like `[email protected]` which the library might interpret as being meant for `evil.example` rather than `trusted.example`. This matters most if your application relies on the Host header to decide where to route requests or whether to trust them. In worst-case scenarios—particularly for API gateways, proxies, or request forwarding services—this could lead to sensitive requests or credentials being sent to an attacker's server instead of the intended destination.

• CVE-2026-49214MEDIUM 5.3

  guzzlehttp/psr7 versions before 2.10.2 fail to sanitize special characters in user-supplied URLs, allowing attackers to inject additional HTTP headers into outbound requests. If your application constructs HTTP requests from untrusted URLs—such as user input, forwarded requests, or webhook destinations—an attacker can craft a malicious URL that breaks out of the host parameter and injects fake headers like `X-Injected: yes`. This becomes especially dangerous when requests are relayed through proxies or load balancers, where the malformed headers can poison caches or trigger request smuggling attacks.