---
id: CVE-2026-59882
title: guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP
summary: >-
  guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior
  to 2.12.3, Uri::assertValidHost() does not reject URI host components
  containing authority delimiters, embedded ports, or malformed IPv6 brackets,
  allowing Uri:…
severity: medium
cvss: 4.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N'
cwe:
  - CWE-436
vendor: guzzlephp
product: psr-7
affected:
  - psr-7 < 2.12.3
patched:
  - psr-7 2.12.3
published: '2026-07-08'
updated: '2026-07-17'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59882'
references:
  - url: >-
      https://github.com/guzzle/psr7/commit/ddd64f17d4cc1f7e5ffe6fd2c989ec7221712580
    label: security-advisories@github.com
  - url: 'https://github.com/guzzle/psr7/pull/811'
    label: security-advisories@github.com
  - url: 'https://github.com/guzzle/psr7/releases/tag/2.12.3'
    label: security-advisories@github.com
  - url: 'https://github.com/guzzle/psr7/security/advisories/GHSA-c2w2-prh8-qm98'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00317
epssPercentile: 0.21952
ingestedAt: '2026-07-17T15:12:52.046Z'
---

## Overview

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3.

## Affected

- `psr-7 < 2.12.3`

## Remediation

Upgrade past the affected range:

- `psr-7 2.12.3`