PT-2026-56500

CVE-2026-59882

Published

2026-07-08

Updated

2026-10-31

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions guzzlehttp/psr7 versions prior to 2.12.3

Description The Uri::assertValidHost() function fails to reject URI host components that contain authority delimiters, embedded ports, or malformed IPv6 brackets. This discrepancy allows Uri::getHost() to return a value that differs from the URI authority used for routing or security decisions.

Recommendations Update to version 2.12.3.

Exploitability

Exploit

Fix

Impacts

Researchers

Grahamcampbell

Vendors

Affected products

Weakness enumeration

CWE-436: Interpretation Conflict

CWE-20: Improper Input Validation