guzzlehttp/psr7 CVE-2026-59882

Exploitation requires two concurrent conditions: first, the target application must run guzzlehttp/psr7 prior to version 2.12.3; second, the application must use Uri::getHost() output - directly or indirectly - to make a security-relevant decision such as SSRF allowlist enforcement, host-based routing, or access policy validation. Applications that ingest user-supplied URI strings are the primary attack surface; if external input cannot influence the URI being parsed, the vulnerability is not reachable. The CVSS AC:H metric confirms that exploitation is not straightforward - the attacker must construct a host string that passes assertValidHost() but produces a deceptive getHost() return value, and the consuming application must use that return value in a security context. Applications that process URIs exclusively for non-security purposes (logging, display, metrics tagging) are not meaningfully at risk even on a vulnerable version.

The CVSS 3.1 base score of 4.2 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) correctly captures network reachability with meaningful constraints: AC:H reflects that exploitation depends on specific URI construction and application usage patterns, and UI:R suggests a user or upstream component must process the crafted URI. The limited C:L/I:L impact scores align with SSRF-class outcomes - internal service exposure and redirected requests - rather than full compromise. No CISA KEV listing and no public POC have been identified, making active exploitation unconfirmed. EPSS data is absent from the provided intelligence. Real-world risk is strongly context-dependent: applications using getHost() as a security gate (SSRF filters, host allowlists, proxy routing) face meaningful exploitation potential, while applications that use the value only for logging or display are functionally unexposed regardless of the CVSS score. The AC:H signal should not be read as low-risk - the required conditions (URI-accepting endpoints with host-based security decisions) are extremely common in PHP microservice and API-gateway architectures.

An attacker targeting a PHP application that uses guzzlehttp/psr7 to enforce an SSRF allowlist (e.g., permitting requests only to 'api.trusted.com') submits a crafted URL such as 'http://api.trusted.com@internal-service.corp/secret' to an endpoint that accepts user-supplied URLs. Uri::assertValidHost() accepts 'api.trusted.com@internal-service.corp' as valid, getHost() returns 'api.trusted.com' which passes the allowlist check, but the HTTP client routes the actual request to 'internal-service.corp', exposing internal services. No public exploit code has been identified at time of analysis, though the technique is consistent with well-documented URI parsing desync research.