46 matches found
CLSA-2026-1788333194 TuxCare security update for guzzlehttp/psr7 (1 CVE)
TuxCare rebuilt guzzlehttp/psr7 to address 1 CVE. Fixed in 1.1.0-p2+tuxcare...
CLSA-2026-1786527009 TuxCare security update for guzzlehttp/psr7 (5 CVEs)
TuxCare rebuilt guzzlehttp/psr7 to address 5 CVEs. Fixed in 1.1.0-p1+tuxcare...
CLSA-2026-1786346242 TuxCare security update for guzzlehttp/psr7 (1 CVE)
TuxCare rebuilt guzzlehttp/psr7 to address 1 CVE. Fixed in 1.9.1-p2+tuxcare...
CLSA-2026-1785554486 TuxCare security update for guzzlehttp/psr7 (2 CVEs)
TuxCare rebuilt guzzlehttp/psr7 to address 2 CVEs. Fixed in 1.4.2-p2+tuxcare...
CLSA-2026-1783991045 TuxCare security update for guzzlehttp/psr7 (3 CVEs)
TuxCare rebuilt guzzlehttp/psr7 to address 3 CVEs. Fixed in 1.4.2-p1+tuxcare...
CLSA-2026-1783991043 TuxCare security update for guzzlehttp/psr7 (3 CVEs)
TuxCare rebuilt guzzlehttp/psr7 to address 3 CVEs. Fixed in 1.9.1-p1+tuxcare...
Improper Input Validation
guzzlehttp/psr7 is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of URI host components in Uri::assertValidHost, which fails to reject authority delimiters, embedded ports, and malformed IPv6 brackets, allowing an attacker to craft malicious URIs tha...
Linux Distros Unpatched Vulnerability : CVE-2026-59882
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost does not reject URI host components containing...
CVE-2026-59882 guzzlehttp/psr7: Host Confusion via Weak URI Host Validation
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost to disagree with the URI authority used for security ...
CVE-2026-59882
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost to disagree with the URI authority used for security ...
CVE-2026-55766
A flaw was found in guzzlehttp/psr7, a PHP library for HTTP messages. This vulnerability allows a remote attacker to inject arbitrary header lines into serialized HTTP/1.x messages. The flaw stems from the library's failure to reject carriage return CR and line feed LF characters in HTTP start-li...
CVE-2026-55766 guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7 did not reject CR/LF characters in certain first-party HTTP start-line fields: the request method, protocol version, and response reason phrase. If an application placed attacker-controlled dat...
CVE-2026-55766
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7 did not reject CR/LF characters in certain first-party HTTP start-line fields: the request method, protocol version, and response reason phrase. If an application placed attacker-controlled dat...
GHSA-VM85-HXW5-5432 guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization
Impact guzzlehttp/psr7 did not reject CR/LF characters in certain first-party HTTP start-line fields: the request method, protocol version, and response reason phrase. If an application placed attacker-controlled data into one of those fields and later serialized the PSR-7 message as raw HTTP/1.x...
CVE-2026-49214
A flaw was found in guzzlehttp/psr7, a PHP library for HTTP messages. This vulnerability allows a remote attacker to inject additional HTTP header lines by providing a specially crafted URL that contains ASCII control characters, whitespace, or DEL in the host component. This improper input...
EUVD-2026-36240
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 did not reject ASCII control characters, whitespace, or DEL in first-party URI host components. A vulnerable flow is: First, an application accepts a user-controlled URL. Second, the URL is used to...
CVE-2026-49214 guzzlehttp/psr7 has CRLF Injection via URI Host Component
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 did not reject ASCII control characters, whitespace, or DEL in first-party URI host components. A vulnerable flow is: First, an application accepts a user-controlled URL. Second, the URL is used to...
CVE-2026-49214 guzzlehttp/psr7 has CRLF Injection via URI Host Component
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 did not reject ASCII control characters, whitespace, or DEL in first-party URI host components. A vulnerable flow is: First, an application accepts a user-controlled URL. Second, the URL is used to...