CVE Feed

    Dashboard / CVE / CVE-2026-59882

    CVE-2026-59882

    guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3.

    Published:Jul 8, 2026
    Last Modified:Jul 10, 2026
    EPS:Jul 8, 2026
    EPSS Score:0.00186
    CVSS Score:4.2

    Affected Products

    Vendor
    Guzzlephp
    Product
    Psr-7

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-436 Interpretation Conflict

    Related CVEs

    CVE-2026-55766 (CVSS 4.8) — guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7 did no…
    CVE-2026-49214 (CVSS 5.3) — guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 did not reject…
    CVE-2026-48998 (CVSS 5.3) — guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improp…
    CVE-2023-29530 (CVSS 7.5) — Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.2…
    CVE-2023-29197 (CVSS 5.3) — guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improp…
    CVE-2022-24775 (CVSS 7.5) — guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High