guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improper Host header validation when parsing raw HTTP request messages and when deriving a server request URI from server variables. An attacker can provide a malformed Host header containing URI authority delimiters, such as `trusted.example@evil.example`. When the Host value is used to construct a URI, the malformed value can be reinterpreted as URI userinfo and host. This can cause the PSR-7 request URI host to differ from the original Host header value. Applications are affected if they parse attacker-controlled raw HTTP requests with `GuzzleHttp\Psr7\Message::parseRequest()` or the legacy 1.x `GuzzleHttp\Psr7\parse_request()` function, or if they build server requests from attacker-controlled server variables, then rely on the resulting URI host for routing, allow-list checks, or forwarding decisions. In affected forwarding or gateway scenarios, this may cause requests or credentials to be sent to an unintended host. The issue is patched in `2.10.2`. `1.x` is end-of-life and will not receive a patch. Some workarounds are available. Validate the `Host` header as `uri-host [ ":" port ]` before calling `Message::parseRequest()` or legacy `parse_request()` on untrusted HTTP request data, or before deriving routing and forwarding decisions from a parsed request URI. Reject Host values containing userinfo, path, query, or fragment delimiters.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain
    improper Host header validation when parsing raw HTTP request messages and when deriving a server request
    URI from server variables. An attacker can provide a malformed Host header containing URI authority
    delimiters, such as `trusted.example@evil.example`. When the Host value is used to construct a URI, the
    malformed value can be reinterpreted as URI userinfo and host. This can cause the PSR-7 request URI host
    to differ from the original Host header value. Applications are affected if they parse attacker-controlled
    raw HTTP requests with `GuzzleHttp\Psr7\Message::parseRequest()` or the legacy 1.x
    `GuzzleHttp\Psr7\parse_request()` function, or if they build server requests from attacker-controlled
    server variables, then rely on the resulting URI host for routing, allow-list checks, or forwarding
    decisions. In affected forwarding or gateway scenarios, this may cause requests or credentials to be sent
    to an unintended host. The issue is patched in `2.10.2`. `1.x` is end-of-life and will not receive a
    patch. Some workarounds are available. Validate the `Host` header as `uri-host [ ":" port ]` before
    calling `Message::parseRequest()` or legacy `parse_request()` on untrusted HTTP request data, or before
    deriving routing and forwarding decisions from a parsed request URI. Reject Host values containing
    userinfo, path, query, or fragment delimiters. (CVE-2026-48998)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain     improper Host header validation when parsing raw HTTP request messages and when deriving a server request     URI from server variables. An attacker can provide a malformed Host header containing URI authority     delimiters, such as `trusted.example@evil.example`. When the Host value is used to construct a URI, the     malformed value can be reinterpreted as URI userinfo and host. This can cause the PSR-7 request URI host     to differ from the original Host header value. Applications are affected if they parse attacker-controlled     raw HTTP requests with `GuzzleHttp\Psr7\Message::parseRequest()` or the legacy 1.x     `GuzzleHttp\Psr7\parse_request()` function, or if they build server requests from attacker-controlled     server variables, then rely on the resulting URI host for routing, allow-list checks, or forwarding     decisions. In affected forwarding or gateway scenarios, this may cause requests or credentials to be sent     to an unintended host. The issue is patched in `2.10.2`. `1.x` is end-of-life and will not receive a     patch. Some workarounds are available. Validate the `Host` header as `uri-host [ : port ]` before     calling `Message::parseRequest()` or legacy `parse_request()` on untrusted HTTP request data, or before     deriving routing and forwarding decisions from a parsed request URI. Reject Host values containing     userinfo, path, query, or fragment delimiters. (CVE-2026-48998)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
443073	SCA: security update for guzzlehttp/psr7 (GHSA-34xg-wgjx-8xph)	Tenable Cloud Security	SCA Checks	medium
443073	SCA: security update for guzzlehttp/psr7 (GHSA-34xg-wgjx-8xph)	Tenable Self-Hosted Container Security	SCA Checks	medium
317944	Linux Distros Unpatched Vulnerability : CVE-2026-48998	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-48998

medium

Tenable Plugins

medium

medium

medium