CVE-2026-59882 guzzlehttp/psr7: Host Confusion via Weak URI Host Validation
Attackers can bypass security or routing checks by crafting URIs with invalid host components that are accepted by the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-59882?
CVE-2026-59882 is a medium-severity vulnerability in guzzle psr7, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3.
Weakness: CWE-436
Which versions are affected by CVE-2026-59882?
2 open source packages ship an affected version, including guzzlehttp/psr7. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
guzzlehttp/psr7 Packagist | All versions | 2.12.3 |
guzzlehttp/psr7 Packagist | All versions | 2.12.3 |
Products include Guzzlephp Psr-7.
How do I fix CVE-2026-59882?
Upgrade guzzlehttp/psr7 to 2.12.3 or later.
Is CVE-2026-59882 being exploited?
There is no known exploitation of CVE-2026-59882 in the wild and no public exploit code.
Other vulnerabilities in guzzle psr7
Sources
Also known as CLSA-2026-1786346242, DEBIAN-CVE-2026-59882, GHSA-c2w2-prh8-qm98, MINI-24x7-9fm2-hj8g, MINI-38gj-qm28-8vcx, MINI-45qf-h482-58r9 and 7 more.