CVE-2026-59882 - Vulnerability Details - OpenCVE

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

References

Link	Providers
https://github.com/guzzle/psr7/commit/ddd64f17d4cc1f7e5ffe6fd2c989ec7221712580
https://github.com/guzzle/psr7/pull/811
https://github.com/guzzle/psr7/releases/tag/2.12.3
https://github.com/guzzle/psr7/security/advisories/GHSA-c2w2-prh8-qm98

History

Wed, 08 Jul 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 08 Jul 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3.
Title		guzzlehttp/psr7: Host Confusion via Weak URI Host Validation
Weaknesses		CWE-436
References		https://github.com/guzzle/psr7/commit/ddd64f17d4cc1f7e5ffe6fd2c989ec7221712580 https://github.com/guzzle/psr7/pull/811 https://github.com/guzzle/psr7/releases/tag/2.12.3 https://github.com/guzzle/psr7/security/advisories/GHSA-c2w2-prh8-qm98
Metrics		cvssV3_1 `{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-07-08T15:50:03.077Z

Updated: 2026-07-08T17:00:22.945Z

Reserved: 2026-07-07T16:40:07.982Z

Link: CVE-2026-59882

Vulnrichment

Updated: 2026-07-08T16:50:29.367Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59882", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-07T16:40:07.982Z", "datePublished": "2026-07-08T15:50:03.077Z", "dateUpdated": "2026-07-08T17:00:22.945Z"}, "containers": {"cna": {"title": "guzzlehttp/psr7: Host Confusion via Weak URI Host Validation", "problemTypes": [{"descriptions": [{"cweId": "CWE-436", "lang": "en", "description": "CWE-436: Interpretation Conflict", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/guzzle/psr7/security/advisories/GHSA-c2w2-prh8-qm98", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/guzzle/psr7/security/advisories/GHSA-c2w2-prh8-qm98"}, {"name": "https://github.com/guzzle/psr7/pull/811", "tags": ["x_refsource_MISC"], "url": "https://github.com/guzzle/psr7/pull/811"}, {"name": "https://github.com/guzzle/psr7/commit/ddd64f17d4cc1f7e5ffe6fd2c989ec7221712580", "tags": ["x_refsource_MISC"], "url": "https://github.com/guzzle/psr7/commit/ddd64f17d4cc1f7e5ffe6fd2c989ec7221712580"}, {"name": "https://github.com/guzzle/psr7/releases/tag/2.12.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/guzzle/psr7/releases/tag/2.12.3"}], "affected": [{"vendor": "guzzle", "product": "psr7", "versions": [{"version": "< 2.12.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T15:50:03.077Z"}, "descriptions": [{"lang": "en", "value": "guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3."}], "source": {"advisory": "GHSA-c2w2-prh8-qm98", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-08T16:50:26.023312Z", "id": "CVE-2026-59882", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-08T17:00:22.945Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59882", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-08T16:50:26.023312Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-08T16:50:29.367Z"}}], "cna": {"title": "guzzlehttp/psr7: Host Confusion via Weak URI Host Validation", "source": {"advisory": "GHSA-c2w2-prh8-qm98", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "guzzle", "product": "psr7", "versions": [{"status": "affected", "version": "< 2.12.3"}]}], "references": [{"url": "https://github.com/guzzle/psr7/security/advisories/GHSA-c2w2-prh8-qm98", "name": "https://github.com/guzzle/psr7/security/advisories/GHSA-c2w2-prh8-qm98", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/guzzle/psr7/pull/811", "name": "https://github.com/guzzle/psr7/pull/811", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/guzzle/psr7/commit/ddd64f17d4cc1f7e5ffe6fd2c989ec7221712580", "name": "https://github.com/guzzle/psr7/commit/ddd64f17d4cc1f7e5ffe6fd2c989ec7221712580", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/guzzle/psr7/releases/tag/2.12.3", "name": "https://github.com/guzzle/psr7/releases/tag/2.12.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-436", "description": "CWE-436: Interpretation Conflict"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T15:50:03.077Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59882", "state": "PUBLISHED", "dateUpdated": "2026-07-08T17:00:22.945Z", "dateReserved": "2026-07-07T16:40:07.982Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-08T15:50:03.077Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}