| Name | CVE-2026-59882 |
| Description | guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| php-guzzlehttp-psr7 (PTS) | bullseye | 1.7.0-1+deb11u2 | vulnerable |
| bookworm | 2.4.5-1+deb12u1 | vulnerable |
| trixie | 2.7.1-1+deb13u1 | vulnerable |
| forky, sid | 2.13.0-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| php-guzzlehttp-psr7 | source | (unstable) | 2.12.3-1 | | | |
Notes
[trixie] - php-guzzlehttp-psr7 <no-dsa> (Minor issue)
[bookworm] - php-guzzlehttp-psr7 <postponed> (Minor issue; weak URI host validation, getHost() can disagree with the authority)
[bullseye] - php-guzzlehttp-psr7 <postponed> (Minor issue; weak URI host validation, getHost() can disagree with the authority)
https://github.com/guzzle/psr7/security/advisories/GHSA-c2w2-prh8-qm98
https://github.com/guzzle/psr7/pull/811
Fixed by: https://github.com/guzzle/psr7/commit/ddd64f17d4cc1f7e5ffe6fd2c989ec7221712580 (2.12.3)