Is CVE-2026-49214 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49214 being exploited in the wild.

How severe is CVE-2026-49214?

Medium severity, with a CVSS score of 5.3, published 11 June 2026.

Which products and versions are affected?

GuzzleHttp Psr7 < 2.10.2; guzzlehttp/psr7 (Packagist) < 2.10.2, ECOSYSTEM:introduced=0,fixed=2.10.2.

Is there a fix for CVE-2026-49214?

Yes. guzzlehttp/psr7 (Packagist): upgrade to 2.10.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49214 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-49214?

Check whether you run GuzzleHttp Psr7 or guzzlehttp/psr7 (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49214: GuzzleHttp PSR-7 CRLF injection in URI host component

Q: Which products and versions are affected?

GuzzleHttp Psr7 < 2.10.2; guzzlehttp/psr7 (Packagist) < 2.10.2, ECOSYSTEM:introduced=0,fixed=2.10.2.

Q: Is there a fix for CVE-2026-49214?

Yes. guzzlehttp/psr7 (Packagist): upgrade to 2.10.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49214 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-49214?

Check whether you run GuzzleHttp Psr7 or guzzlehttp/psr7 (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49214 · Severity: medium · CVSS 5.3 · Published 2026-06-11

A vulnerability in the GuzzleHttp PSR-7 library, a common tool for handling web requests in PHP applications, could allow attackers to manipulate network traffic. By providing a specially crafted web address (URL), an attacker can inject extra instructions into the communication between servers. This can lead to unauthorized actions like bypassing security filters or poisoning web caches, potentially affecting how data is served to other users.

Technologies: GuzzleHttp Psr7, guzzlehttp/psr7 (Packagist). Vendors: GuzzleHttp, Packagist.

Quick answers

Is CVE-2026-49214 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49214 being exploited in the wild.
How severe is CVE-2026-49214?: Medium severity, with a CVSS score of 5.3, published 11 June 2026.
Which products and versions are affected?: GuzzleHttp Psr7 < 2.10.2; guzzlehttp/psr7 (Packagist) < 2.10.2, ECOSYSTEM:introduced=0,fixed=2.10.2.
Is there a fix for CVE-2026-49214?: Yes. guzzlehttp/psr7 (Packagist): upgrade to 2.10.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49214 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-49214?: Check whether you run GuzzleHttp Psr7 or guzzlehttp/psr7 (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

guzzlehttp/psr7 (Packagist): upgrade to 2.10.2 or later
```
composer require guzzlehttp/psr7:^2.10.2
```

Technical details

The GuzzleHttp PSR-7 library fails to properly validate or reject ASCII control characters (such as CRLF), whitespace, or DEL characters in the host component of a URI. When an application constructs a PSR-7 Request or Uri object using a user-controlled URL and subsequently serializes it into a raw HTTP/1.x message (e.g., via Message::toString()), these characters are injected into the Host header. This allows a remote attacker to perform HTTP request splitting, potentially leading to request smuggling or cache poisoning in environments with proxies or load balancers. The vulnerability primarily affects applications that manually serialize requests or use custom transports rather than the standard Guzzle HTTP client. A fix is available in version 2.10.2.

Affected products

GuzzleHttp psr7 < 2.10.2

Identifiers

CVE-2026-49214
GHSA-hq7v-mx3g-29hw

Timeline

2026-05-25: disclosed
2026-06-11: advisory: GitHub Advisory published
2026-06-11: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.