Quick answers
- Is CVE-2026-48998 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-48998 being exploited in the wild.
- How severe is CVE-2026-48998?
- Medium severity, with a CVSS score of 5.3, published 11 June 2026.
- Which products and versions are affected?
- GuzzleHttp Psr7 < 2.10.2; guzzlehttp/psr7 (Packagist) < 2.10.2, ECOSYSTEM:introduced=0,fixed=2.10.2.
- Is there a fix for CVE-2026-48998?
- Yes. guzzlehttp/psr7 (Packagist): upgrade to 2.10.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-48998 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-48998?
- Check whether you run GuzzleHttp Psr7 or guzzlehttp/psr7 (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- guzzlehttp/psr7 (Packagist): upgrade to 2.10.2 or later
composer require guzzlehttp/psr7:^2.10.2
Technical details
The GuzzleHttp psr7 library improperly interprets malformed Host header values containing URI authority delimiters (such as the '@' symbol) when constructing request URIs from inbound data. When a Host header like 'trusted.example@evil.example' is processed, the parser may treat the portion before the '@' as user information and the portion after as the actual host. This results in a PSR-7 URI host that differs from the original header value. Attackers can exploit this in gateway or forwarding scenarios to bypass allow-lists or redirect requests to unintended destinations. The issue is fixed in version 2.10.2; version 1.x is end-of-life and will not be patched.
Affected products
- GuzzleHttp psr7 < 2.10.2
Identifiers
- CVE-2026-48998
- GHSA-34xg-wgjx-8xph
Timeline
- 2026-05-25: disclosed
- 2026-06-11: advisory