Executive Summary

CVE-2026-48998 is a vulnerability in the guzzlehttp/psr7 PHP library, which implements PSR-7 HTTP message handling. Versions before 2.10.2 improperly validate the Host header when parsing raw HTTP requests or deriving server request URIs. An attacker can send a malformed Host header containing URI authority delimiters like an '@' symbol, causing the library to misinterpret the Host value as containing userinfo and host parts.

This misinterpretation can cause the URI host derived by the library to differ from the original Host header, potentially leading applications to route requests or apply security checks incorrectly. The vulnerability affects applications that parse attacker-controlled raw HTTP requests using vulnerable functions and then rely on the resulting URI host for routing, allow-list checks, or forwarding decisions.

The issue is fixed in version 2.10.2. Workarounds include validating the Host header to ensure it only contains a valid URI host and optional port before parsing or making routing decisions.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in guzzlehttp/psr7 involves improper validation of the Host header, which can lead to requests or credentials being sent to unintended hosts. This misrouting or forwarding of requests could potentially expose sensitive data or credentials to unauthorized parties.

Such exposure or misrouting of data may impact compliance with standards and regulations like GDPR or HIPAA, which require protection of personal and sensitive information and mandate secure handling of data to prevent unauthorized access or disclosure.

However, the CVE description and resources do not explicitly mention compliance impacts or specific regulatory consequences.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing your application to route requests or select credentials based on a misinterpreted Host header. In scenarios where your application forwards requests or acts as a gateway, this can lead to requests or sensitive credentials being sent to an unintended or malicious host.

Such misrouting can result in information disclosure, unauthorized access, or other security issues because the application trusts the manipulated URI host derived from the malformed Host header.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring HTTP requests for malformed Host headers containing URI authority delimiters such as the '@' symbol, which may indicate exploitation attempts.

Specifically, look for Host header values that include userinfo, path, query, or fragment delimiters that are not normally valid.

Commands to detect such attempts could include using network traffic inspection tools or command-line utilities like grep or tcpdump to filter HTTP requests with suspicious Host headers.

• Using tcpdump to capture HTTP traffic and filter Host headers containing '@': tcpdump -A -s 0 'tcp port 80' | grep -i 'Host:.*@'
• Using grep on web server logs to find suspicious Host headers: grep -i 'Host:.*@' /var/log/httpd/access_log
• Implement application-level logging to detect when Host headers with malformed values are parsed by vulnerable functions like Message::parseRequest() or parse_request().

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the guzzlehttp/psr7 library to version 2.10.2 or later, where this vulnerability is patched.

If upgrading is not immediately possible, implement validation of the Host header before parsing or using it for routing or forwarding decisions.

• Validate that the Host header matches the pattern of a valid URI host optionally followed by a port, rejecting any Host values containing userinfo, path, query, fragment delimiters, whitespace, or control characters.
• Reject or sanitize incoming HTTP requests with malformed Host headers before passing them to vulnerable parsing functions like Message::parseRequest() or parse_request().

Note that version 1.x of guzzlehttp/psr7 is end-of-life and will not receive a patch, so migration to 2.10.2 or later is strongly recommended.

Useful 0 Not Useful 0