CVE-2026-59882: guzzlehttp/psr7 URI Host Validation Bypass (CVSS 4.2)

Technical summary

The vulnerability exists in the Uri::assertValidHost() method, which does not properly validate the host component of URIs according to RFC specifications. Specifically, it fails to reject: (1) authority delimiters such as '@' that signal a userinfo component, (2) port numbers embedded within the host field itself, and (3) malformed IPv6 address bracket syntax. Because Uri::getHost() may return a value that differs from the actual host used in the authority section of the URI, applications using this library for host-based access control, CORS validation, Host header verification, or routing decisions may be bypassed or misdirected. The issue affects all versions prior to 2.12.3.

Business impact

Organizations using guzzlehttp/psr7 in applications that enforce host-based security policies face a potential bypass risk. HTTP client libraries are foundational to modern web applications, APIs, and microservices. If an application relies on the reported host to enforce authentication, authorization, or routing rules, an attacker could craft a malicious request that passes validation but is interpreted differently by the remote server or by downstream security controls. This is particularly concerning in API gateways, service mesh implementations, and applications handling sensitive inter-service communication.

Affected systems

guzzlehttp/psr7 versions prior to 2.12.3 are affected. Any PHP application or framework that depends on this library is potentially impacted, including Guzzle HTTP client users, Symfony applications, Laravel projects, and any custom code leveraging psr-7 URI handling. The exposure is greatest in environments where host validation is part of the security perimeter.

Exploitability

The vulnerability requires user interaction (UI:R in the CVSS vector), meaning an attacker cannot exploit this in a fully automated attack against a server. Instead, a victim must trigger the vulnerable code path—for example, by visiting a malicious link, processing a specially-crafted request from a third party, or interacting with an untrusted data source. The attack vector is network-based (AV:N) with high complexity (AC:H), reflecting the need for precise crafting of a malicious URI and reliance on how the application uses the host value. No CVSS environmental factors or privilege elevation are required.

Remediation

Upgrade guzzlehttp/psr7 to version 2.12.3 or later, which includes fixes to Uri::assertValidHost() that properly reject URIs with authority delimiters, embedded ports, and malformed IPv6 brackets. Verify your Composer lock file reflects the patched version and regenerate any cached autoloader configurations. For applications unable to upgrade immediately, review host validation logic in your application code and implement additional validation at the application layer if host-based security decisions are critical.

Patch guidance

Update via Composer: run 'composer update guzzlehttp/psr7' to pull version 2.12.3 or later. Verify the update in composer.lock; the entry for guzzlehttp/psr7 should reflect version 2.12.3 with the corresponding commit hash from the patch release. If your application pins a specific version range, ensure it includes 2.12.3 (e.g., ^2.12.3 or ~2.12.3). After updating, run your test suite to confirm no breaking changes; PSR-7 compliance improvements should not affect properly-written applications.

Detection guidance

Monitor application logs for URI parsing exceptions or validation failures after this vulnerability is disclosed; attackers may probe your application with malformed URIs before attempting exploitation. Review access logs for unusual Host header values containing '@', embedded colons, or IPv6-like patterns in unexpected contexts. If you maintain custom security rules based on host extraction, audit them to ensure they do not rely solely on Uri::getHost() output without additional validation. Consider implementing a Web Application Firewall (WAF) rule to reject requests with authority delimiters or suspicious host formatting at the perimeter.

Why prioritize this

Although this vulnerability has a MEDIUM CVSS score (4.2) and is not yet listed in the CISA Known Exploited Vulnerabilities catalog, it affects a foundational PHP library with widespread use. The flaw directly undermines host-based security decisions, which are common in API security, microservice authorization, and multi-tenant isolation. Organizations running applications that depend on accurate host validation for security should prioritize patching within their next maintenance cycle. The requirement for user interaction and high attack complexity reduce the immediate threat, but the fundamental nature of the bypass makes it strategically important for applications handling sensitive or inter-service traffic.

Risk score, explained

The CVSS 3.1 score of 4.2 (MEDIUM) reflects: (1) Network accessibility (AV:N) but requiring specific URI crafting; (2) High complexity (AC:H) due to the need to trigger the code path and have the bypassed host validation affect a security decision; (3) Required user interaction (UI:R), preventing fully automated exploitation; (4) Limited impact scope (S:U) affecting only the vulnerable service; (5) Low confidentiality and integrity impact (C:L, I:L) from successful host bypasses, with no availability impact (A:N). The score appropriately captures that exploitation is not trivial and depends on application-specific trust of Uri::getHost() output.

Frequently asked questions