Executive brief
A vulnerability in the GuzzleHttp PSR-7 library, a common tool for handling web requests in PHP applications, could allow attackers to manipulate network traffic. By providing a specially crafted web address (URL), an attacker can inject extra instructions into the communication between servers. This can lead to unauthorized actions like bypassing security filters or poisoning web caches, potentially affecting how data is served to other users.
Technical details
The GuzzleHttp PSR-7 library fails to properly validate or reject ASCII control characters (such as CRLF), whitespace, or DEL characters in the host component of a URI. When an application constructs a PSR-7 Request or Uri object using a user-controlled URL and subsequently serializes it into a raw HTTP/1.x message (e.g., via Message::toString()), these characters are injected into the Host header. This allows a remote attacker to perform HTTP request splitting, potentially leading to request smuggling or cache poisoning in environments with proxies or load balancers. The vulnerability primarily affects applications that manually serialize requests or use custom transports rather than the standard Guzzle HTTP client. A fix is available in version 2.10.2.
Affected products
- GuzzleHttp psr7 < 2.10.2
Timeline
- 2026-05-25: disclosed
- 2026-06-11: advisory: GitHub Advisory published
- 2026-06-11: patched