{
  "cveId": "CVE-2026-48998",
  "url": "https://patchblox.com/security/cve/CVE-2026-48998",
  "summary": "CVE-2026-48998 is fixed in php-guzzlehttp-psr7 on 1 platform, first by DEBIAN-CVE-2026-48998, released June 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "php-guzzlehttp-psr7: guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP",
  "description": "guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improper Host header validation when parsing raw HTTP request messages and when deriving a server request URI from server variables. An attacker can provide a malformed Host header containing URI authority delimiters, such as \u0060trusted.example@evil.example\u0060. When the Host value is used to construct a URI, the malformed value can be reinterpreted as URI userinfo and host. This can cause the PSR-7 request URI host to differ from the original Host header value. Applications are affected if they parse attacker-controlled raw HTTP requests with \u0060GuzzleHttp\\Psr7\\Message::parseRequest()\u0060 or the legacy 1.x \u0060GuzzleHttp\\Psr7\\parse_request()\u0060 function, or if they build server requests from attacker-controlled server variables, then rely on the resulting URI host for routing, allow-list checks, or forwarding decisions. In affected forwarding or gateway scenarios, this may cause requests or credentials to be sent to an unintended host. The issue is patched in \u00602.10.2\u0060. \u00601.x\u0060 is end-of-life and will not receive a patch. Some workarounds are available. Validate the \u0060Host\u0060 header as \u0060uri-host [ \u0022:\u0022 port ]\u0060 before calling \u0060Message::parseRequest()\u0060 or legacy \u0060parse_request()\u0060 on untrusted HTTP request data, or before deriving routing and forwarding decisions from a parsed request URI. Reject Host values containing userinfo, path, query, or fragment delimiters.",
  "published": "2026-06-11T13:16:33Z",
  "severity": "medium",
  "cvss": 5.3,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "epss": 0.00198,
  "epssPercentile": 0.0964,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "php-guzzlehttp-psr7",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "2.4.5-1\u002Bdeb12u1",
      "fix": "DEBIAN-CVE-2026-48998",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-48998",
      "released": "2026-06-24T14:07:24Z"
    },
    {
      "platform": "linux",
      "product": "php-guzzlehttp-psr7",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2.7.1-1\u002Bdeb13u1",
      "fix": "DEBIAN-CVE-2026-48998",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-48998",
      "released": "2026-06-24T14:07:24Z"
    },
    {
      "platform": "linux",
      "product": "php-guzzlehttp-psr7",
      "release": "Debian 14",
      "fixedVersion": "2.10.3-1",
      "fix": "DEBIAN-CVE-2026-48998",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-48998",
      "released": "2026-06-24T14:07:24Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}