# CVE-2026-48998: GuzzleHttp PSR-7 Host confusion via authority reinterpretation

Source: https://junglewise.ai/threats/cve-2026-48998-guzzlehttp-psr-7-host-confusion-via-authority-reinterpretation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-11. Updated: 2026-06-11  
License: CC BY 4.0 with a link back

CVE-2026-48998 · Severity: medium · CVSS 5.3 · Published 2026-06-11

GuzzleHttp psr7 is a library used by PHP applications to handle web requests. A vulnerability exists where the library incorrectly processes certain web addresses (Host headers) that contain special characters. This could allow an attacker to trick an application into sending sensitive information or routing traffic to a malicious server instead of the intended destination.

Technologies: [GuzzleHttp Psr7](https://junglewise.ai/threats/technologies/psr7), [guzzlehttp/psr7 (Packagist)](https://junglewise.ai/threats/technologies/guzzlehttp-psr7). Vendors: [GuzzleHttp](https://junglewise.ai/threats/vendors/guzzlehttp), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-48998 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48998 being exploited in the wild.

**How severe is CVE-2026-48998?** Medium severity, with a CVSS score of 5.3, published 11 June 2026.

**Which products and versions are affected?** GuzzleHttp Psr7 < 2.10.2; guzzlehttp/psr7 (Packagist) < 2.10.2, ECOSYSTEM:introduced=0,fixed=2.10.2.

**Is there a fix for CVE-2026-48998?** Yes. guzzlehttp/psr7 (Packagist): upgrade to 2.10.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48998 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48998?** Check whether you run GuzzleHttp Psr7 or guzzlehttp/psr7 (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- guzzlehttp/psr7 (Packagist): upgrade to 2.10.2 or later

  ```sh
  composer require guzzlehttp/psr7:^2.10.2
  ```


## Technical details

The GuzzleHttp psr7 library improperly interprets malformed Host header values containing URI authority delimiters (such as the '@' symbol) when constructing request URIs from inbound data. When a Host header like 'trusted.example@evil.example' is processed, the parser may treat the portion before the '@' as user information and the portion after as the actual host. This results in a PSR-7 URI host that differs from the original header value. Attackers can exploit this in gateway or forwarding scenarios to bypass allow-lists or redirect requests to unintended destinations. The issue is fixed in version 2.10.2; version 1.x is end-of-life and will not be patched.

## Affected products

- GuzzleHttp psr7 < 2.10.2

## Identifiers

- CVE-2026-48998
- GHSA-34xg-wgjx-8xph

## Timeline

- 2026-05-25: disclosed
- 2026-06-11: advisory

## References

- [https://api.github.com/users/edorian](https://api.github.com/users/edorian)
- [https://github.com/edorian](https://github.com/edorian)
- [https://api.github.com/users/edorian/gists%7B/gist_id%7D](https://api.github.com/users/edorian/gists%7B/gist_id%7D)
- [https://api.github.com/users/edorian/repos](https://api.github.com/users/edorian/repos)
- [https://avatars.githubusercontent.com/u/247397?v=4](https://avatars.githubusercontent.com/u/247397?v=4)
- [https://api.github.com/users/edorian/events%7B/privacy%7D](https://api.github.com/users/edorian/events%7B/privacy%7D)

## Related threats

- [Guzzle PSR-7 host confusion via weak URI host validation](https://junglewise.ai/threats/cve-2026-59882-guzzle-psr-7-host-confusion-via-weak-uri-host-validation)
- [Guzzle PSR-7 CRLF injection in HTTP start-line serialization](https://junglewise.ai/threats/cve-2026-55766-guzzle-psr-7-crlf-injection-in-http-start-line-serialization)
- [GuzzleHttp PSR-7 CRLF injection in URI host component](https://junglewise.ai/threats/cve-2026-49214-guzzlehttp-psr-7-crlf-injection-in-uri-host-component)
- [Improper header name validation in guzzlehttp/psr7](https://junglewise.ai/threats/cve-2023-29197-improper-header-name-validation-in-guzzlehttp-psr7)
- [Improper Input Validation in guzzlehttp/psr7](https://junglewise.ai/threats/cve-2022-24775-drupal-core-2022-006-drupal-uses-the-third-party-guzzle-library)