CLSA-2026-1788333194 TuxCare security update for guzzlehttp/psr7 (1 CVE)

TuxCare rebuilt guzzlehttp/psr7 to address 1 CVE. Fixed in 1.1.0-p2+tuxcare...

PT-2026-90624

TuxCare rebuilt guzzlehttp/psr7 to address 1 CVE. Fixed in 1.1.0-p2+tuxcare...

CLSA-2026-1786527009 TuxCare security update for guzzlehttp/psr7 (5 CVEs)

TuxCare rebuilt guzzlehttp/psr7 to address 5 CVEs. Fixed in 1.1.0-p1+tuxcare...

PT-2026-80103

TuxCare rebuilt guzzlehttp/psr7 to address 5 CVEs. Fixed in 1.1.0-p1+tuxcare...

CLSA-2026-1786346242 TuxCare security update for guzzlehttp/psr7 (1 CVE)

TuxCare rebuilt guzzlehttp/psr7 to address 1 CVE. Fixed in 1.9.1-p2+tuxcare...

PT-2026-80011

TuxCare rebuilt guzzlehttp/psr7 to address 1 CVE. Fixed in 1.9.1-p2+tuxcare...

CLSA-2026-1785554486 TuxCare security update for guzzlehttp/psr7 (2 CVEs)

TuxCare rebuilt guzzlehttp/psr7 to address 2 CVEs. Fixed in 1.4.2-p2+tuxcare...

CLSA-2026-1783991043 TuxCare security update for guzzlehttp/psr7 (3 CVEs)

TuxCare rebuilt guzzlehttp/psr7 to address 3 CVEs. Fixed in 1.9.1-p1+tuxcare...

CLSA-2026-1783991045 TuxCare security update for guzzlehttp/psr7 (3 CVEs)

TuxCare rebuilt guzzlehttp/psr7 to address 3 CVEs. Fixed in 1.4.2-p1+tuxcare...

PT-2026-75852

TuxCare rebuilt guzzlehttp/psr7 to address 2 CVEs. Fixed in 1.4.2-p2+tuxcare...

PT-2026-75394

TuxCare rebuilt guzzlehttp/psr7 to address 3 CVEs. Fixed in 1.4.2-p1+tuxcare...

PT-2026-75392

TuxCare rebuilt guzzlehttp/psr7 to address 3 CVEs. Fixed in 1.9.1-p1+tuxcare...

Improper Input Validation

guzzlehttp/psr7 is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of URI host components in Uri::assertValidHost, which fails to reject authority delimiters, embedded ports, and malformed IPv6 brackets, allowing an attacker to craft malicious URIs tha...

Linux Distros Unpatched Vulnerability : CVE-2026-59882

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost does not reject URI host components containing...

CVE-2026-59882 guzzlehttp/psr7: Host Confusion via Weak URI Host Validation

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost to disagree with the URI authority used for security ...

CVE-2026-59882

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost to disagree with the URI authority used for security ...

CVE-2026-59882: Interpretation Conflict

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost to disagree with the URI authority used for security ...

CVE-2026-55766

A flaw was found in guzzlehttp/psr7, a PHP library for HTTP messages. This vulnerability allows a remote attacker to inject arbitrary header lines into serialized HTTP/1.x messages. The flaw stems from the library's failure to reject carriage return CR and line feed LF characters in HTTP start-li...

CVE-2026-55766

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7 did not reject CR/LF characters in certain first-party HTTP start-line fields: the request method, protocol version, and response reason phrase. If an application placed attacker-controlled dat...

CVE-2026-55766 guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7 did not reject CR/LF characters in certain first-party HTTP start-line fields: the request method, protocol version, and response reason phrase. If an application placed attacker-controlled dat...