CVE catalog

CVE-2026-59882

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or m

[CVE catalog]

Severity
Medium · CVSS 4.2CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.32% · Oct 25, 2026

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianphp-guzzlehttp-psr7sid2.13.1-1fixed
Debianphp-guzzlehttp-psr7forky2.13.1-1fixed
Debianphp-guzzlehttp-psr7trixie2.7.1-1+deb13u2vulnerable
Debianphp-guzzlehttp-psr7bookworm2.4.5-1+deb12u1vulnerable
Cpephp-guzzlehttp-psr7Not reportedNot reportedvulnerable
Composerguzzlehttp/psr7Not reported2.12.3fixed
Ubuntuphp-guzzlehttp-psr716.041.1.0-1vulnerable
Ubuntuphp-guzzlehttp-psr716.041.2.0-1vulnerable
Ubuntuphp-guzzlehttp-psr716.041.2.1-1vulnerable
Ubuntuphp-guzzlehttp-psr716.041.2.2-1vulnerable
Ubuntuphp-guzzlehttp-psr716.041.2.2-1build1vulnerable
Ubuntuphp-guzzlehttp-psr716.041.2.2-1ubuntu1vulnerable
Ubuntuphp-guzzlehttp-psr720.041.4.2-0.1vulnerable
Ubuntuphp-guzzlehttp-psr720.041.4.2-0.1+deb10u2build0.20.04.1vulnerable
Ubuntuphp-guzzlehttp-psr7pro1.7.0-1vulnerable
Ubuntuphp-guzzlehttp-psr7pro1.8.3-1vulnerable
Ubuntuphp-guzzlehttp-psr7pro1.8.3-1ubuntu0.1~esm1vulnerable
Ubuntuphp-guzzlehttp-psr724.042.6.0-1vulnerable
Ubuntuphp-guzzlehttp-psr724.042.6.1-1vulnerable
Ubuntuphp-guzzlehttp-psr724.042.6.2-1vulnerable
Ubuntuphp-guzzlehttp-psr725.102.7.0-3vulnerable
Ubuntuphp-guzzlehttp-psr725.102.7.1-1vulnerable
Ubuntuphp-guzzlehttp-psr726.042.7.1-1vulnerable
Ubuntuphp-guzzlehttp-psr726.042.8.0-1vulnerable
Ubuntuphp-guzzlehttp-psr726.042.8.0-2vulnerable
Cpepsr-7Not reported2.12.3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianphp-guzzlehttp-psr7sourcesid2.12.3-1not yet assignedNot reportedNot reported
Debianphp-guzzlehttp-psr7sourceforky2.12.3-1not yet assignedNot reportedNot reported
Debianphp-guzzlehttp-psr7sourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianphp-guzzlehttp-psr7sourcebookworm(unfixed)not yet assignedNot reportedNot reported
Composerguzzlehttp/psr7composerNot reported2.12.3Not reportedNot reportedNot reported
Cpepsr-7cpeNot reported2.12.3Not reportedNVD-CVE-2026-59882Not reported

Notes

[trixie] php-guzzlehttp-psr7: Minor issue [bookworm] php-guzzlehttp-psr7: Minor issue; weak URI host validation, getHost() can disagree with the authority

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [php-guzzlehttp-psr7]Affected
    Details (2)

    • 2.4.5-1+deb12u1 · all · bookworm

      Affected

      nvd · php-guzzlehttp-psr7 · debian · bookworm; nvd · php-guzzlehttp-psr7 · debian · 12

    • 2.4.5-1+deb12u1 · all · bookworm

      Affected

      nvd · php-guzzlehttp-psr7 · debian · bookworm; nvd · php-guzzlehttp-psr7 · debian · 12

[Debian 13 (Trixie)]

  • [php-guzzlehttp-psr7]Affected
    Details (2)

    • 2.7.1-1+deb13u1 · all · trixie

      Affected

      nvd · php-guzzlehttp-psr7 · debian · 13

    • 2.7.1-1+deb13u1 · all · trixie

      Affected

      nvd · php-guzzlehttp-psr7 · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]