CVE-2026-48998: GuzzleHttp PSR-7 Host confusion via authority reinterpretation

Executive brief

GuzzleHttp psr7 is a library used by PHP applications to handle web requests. A vulnerability exists where the library incorrectly processes certain web addresses (Host headers) that contain special characters. This could allow an attacker to trick an application into sending sensitive information or routing traffic to a malicious server instead of the intended destination.

Technical details

The GuzzleHttp psr7 library improperly interprets malformed Host header values containing URI authority delimiters (such as the '@' symbol) when constructing request URIs from inbound data. When a Host header like 'trusted.example@evil.example' is processed, the parser may treat the portion before the '@' as user information and the portion after as the actual host. This results in a PSR-7 URI host that differs from the original header value. Attackers can exploit this in gateway or forwarding scenarios to bypass allow-lists or redirect requests to unintended destinations. The issue is fixed in version 2.10.2; version 1.x is end-of-life and will not be patched.

Affected products

• GuzzleHttp psr7 < 2.10.2

Timeline

• 2026-05-25: disclosed
• 2026-06-11: advisory

References

• https://api.github.com/users/edorian
• https://github.com/edorian
• https://api.github.com/users/edorian/gists%7B/gist_id%7D
• https://api.github.com/users/edorian/repos
• https://avatars.githubusercontent.com/u/247397?v=4
• https://api.github.com/users/edorian/events%7B/privacy%7D