https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 16:57:55 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-326664 EUVD-2026-326664 https://cve.radiocsirt.org/vuln/euvd-2026-326664 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48998 <p>guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improper Host header validation when parsing raw HTTP request messages and when deriving a server request URI from server variables. An attacker can provide a malformed Host header containing URI authority delimiters, such as `trusted.example@evil.example`. When the Host value is used to construct a URI, the malformed value can be reinterpreted as URI userinfo and host. This can cause the PSR-7 request URI host to differ from the original Host header value. Applications are affected if they parse attacker-controlled raw HTTP requests with `GuzzleHttp\Psr7\Message::parseRequest()` or the legacy 1.x `GuzzleHttp\Psr7\parse_request()` function, or if they build server requests from attacker-controlled server variables, then rely on the resulting URI host for routing, allow-list checks, or forwarding decisions. In affected forwarding or gateway scenarios, this may cause requests or credentials to be sent to an unintended host. The issue is patched in `2.10.2`. `1.x` is end-of-life and will not receive a patch. Some workarounds are available. Validate the `Host` header as `uri-host [ &#34;:&#34; port ]` before calling `Message::parseRequest()` or legacy `parse_request()` on untrusted HTTP request data, or before deriving routing and forwarding decisions from a parsed request URI. Reject Host values containing userinfo, path, query, or fragment delimiters.</p> <p>guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improper Host header validation when parsing raw HTTP request messages and when deriving a server request URI from server variables. An attacker can provide a malformed Host header containing URI authority delimiters, such as `trusted.example@evil.example`. When the Host value is used to construct a URI, the malformed value can be reinterpreted as URI userinfo and host. This can cause the PSR-7 request URI host to differ from the original Host header value. Applications are affected if they parse attacker-controlled raw HTTP requests with `GuzzleHttp\Psr7\Message::parseRequest()` or the legacy 1.x `GuzzleHttp\Psr7\parse_request()` function, or if they build server requests from attacker-controlled server variables, then rely on the resulting URI host for routing, allow-list checks, or forwarding decisions. In affected forwarding or gateway scenarios, this may cause requests or credentials to be sent to an unintended host. The issue is patched in `2.10.2`. `1.x` is end-of-life and will not receive a patch. Some workarounds are available. Validate the `Host` header as `uri-host [ &#34;:&#34; port ]` before calling `Message::parseRequest()` or legacy `parse_request()` on untrusted HTTP request data, or before deriving routing and forwarding decisions from a parsed request URI. Reject Host values containing userinfo, path, query, or fragment delimiters.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-48998 https://cve.radiocsirt.org/vuln/ghsa-34xg-wgjx-8xph <p><strong>Affected:</strong> Packagist: guzzlehttp/psr7</p> <p>## Impact</p> <p>`guzzlehttp/psr7` improperly interpreted malformed `Host` header values when constructing request URIs from inbound request data. This issue concerns inbound request parsing and server request construction. It does not require serializing a PSR-7 request, and it is not part of the normal outbound request-sending path used by `guzzlehttp/guzzle`.</p> <p>A vulnerable flow is:</p> <p>1. An attacker controls a raw HTTP request or server variable containing a `Host` value. 2. The `Host` value contains URI authority delimiters, such as `trusted.example@evil.example`. 3. `guzzlehttp/psr7` uses that value to construct a URI. 4. The URI parser treats the portion before `@` as userinfo and the portion after `@` as the URI host. 5. The resulting PSR-7 request URI host differs from the original `Host` header value.</p> <p>For example, `Host: trusted.example@evil.example` can result in a PSR-7 URI whose host is `evil.example`, while the original Host header value remains `trusted.example@evil.example`.</p> <p>Applications are affected if they parse attacker-controlled raw HTTP requests with `GuzzleHttp\Psr7\Message::parseRequest()` or the legacy 1.x `GuzzleHttp\Psr7\parse_request()` function, or if they build server requests from attacker-controlled server variables with `GuzzleHttp\Psr7\ServerRequest::fromGlobals()` or `GuzzleHttp\Psr7\ServerRequest::getUriFromGlobals()`, and then rely on the resulting URI host for routing, allow-list checks, credential selection, or forwarding decisions. Applicatio…</p> <p><strong>Affected:</strong> Packagist: guzzlehttp/psr7</p> <p>## Impact</p> <p>`guzzlehttp/psr7` improperly interpreted malformed `Host` header values when constructing request URIs from inbound request data. This issue concerns inbound request parsing and server request construction. It does not require serializing a PSR-7 request, and it is not part of the normal outbound request-sending path used by `guzzlehttp/guzzle`.</p> <p>A vulnerable flow is:</p> <p>1. An attacker controls a raw HTTP request or server variable containing a `Host` value. 2. The `Host` value contains URI authority delimiters, such as `trusted.example@evil.example`. 3. `guzzlehttp/psr7` uses that value to construct a URI. 4. The URI parser treats the portion before `@` as userinfo and the portion after `@` as the URI host. 5. The resulting PSR-7 request URI host differs from the original `Host` header value.</p> <p>For example, `Host: trusted.example@evil.example` can result in a PSR-7 URI whose host is `evil.example`, while the original Host header value remains `trusted.example@evil.example`.</p> <p>Applications are affected if they parse attacker-controlled raw HTTP requests with `GuzzleHttp\Psr7\Message::parseRequest()` or the legacy 1.x `GuzzleHttp\Psr7\parse_request()` function, or if they build server requests from attacker-controlled server variables with `GuzzleHttp\Psr7\ServerRequest::fromGlobals()` or `GuzzleHttp\Psr7\ServerRequest::getUriFromGlobals()`, and then rely on the resulting URI host for routing, allow-list checks, credential selection, or forwarding decisions. Applicatio…</p> https://cve.radiocsirt.org/vuln/ghsa-34xg-wgjx-8xph https://cve.radiocsirt.org/vuln/ncsc-2026-0375 NCSC-2026-0375 https://cve.radiocsirt.org/vuln/ncsc-2026-0375 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-48998 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: php-guzzlehttp-psr7, Ubuntu:20.04:LTS: php-guzzlehttp-psr7, Ubuntu:Pro:22.04:LTS: php-guzzlehttp-psr7, Ubuntu:24.04:LTS: php-guzzlehttp-psr7, Ubuntu:25.10: php-guzzlehttp-psr7, Ubuntu:26.04:LTS: php-guzzlehttp-psr7</p> <p>guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improper Host header validation when parsing raw HTTP request messages and when deriving a server request URI from server variables. An attacker can provide a malformed Host header containing URI authority delimiters, such as `trusted.example@evil.example`. When the Host value is used to construct a URI, the malformed value can be reinterpreted as URI userinfo and host. This can cause the PSR-7 request URI host to differ from the original Host header value. Applications are affected if they parse attacker-controlled raw HTTP requests with `GuzzleHttp\Psr7\Message::parseRequest()` or the legacy 1.x `GuzzleHttp\Psr7\parse_request()` function, or if they build server requests from attacker-controlled server variables, then rely on the resulting URI host for routing, allow-list checks, or forwarding decisions. In affected forwarding or gateway scenarios, this may cause requests or credentials to be sent to an unintended host. The issue is patched in `2.10.2`. `1.x` is end-of-life and will not receive a patch. Some workarounds are available. Validate the `Host` header as `uri-host [ &#34;:&#34; port ]` before calling `Message::parseRequest()` or legacy `parse_request()` on untrusted HTTP request data, or before deriving routing and forwarding decisions from a parsed request URI. Reject Host values containing userinfo, path, query, or fragment delimiters.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: php-guzzlehttp-psr7, Ubuntu:20.04:LTS: php-guzzlehttp-psr7, Ubuntu:Pro:22.04:LTS: php-guzzlehttp-psr7, Ubuntu:24.04:LTS: php-guzzlehttp-psr7, Ubuntu:25.10: php-guzzlehttp-psr7, Ubuntu:26.04:LTS: php-guzzlehttp-psr7</p> <p>guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improper Host header validation when parsing raw HTTP request messages and when deriving a server request URI from server variables. An attacker can provide a malformed Host header containing URI authority delimiters, such as `trusted.example@evil.example`. When the Host value is used to construct a URI, the malformed value can be reinterpreted as URI userinfo and host. This can cause the PSR-7 request URI host to differ from the original Host header value. Applications are affected if they parse attacker-controlled raw HTTP requests with `GuzzleHttp\Psr7\Message::parseRequest()` or the legacy 1.x `GuzzleHttp\Psr7\parse_request()` function, or if they build server requests from attacker-controlled server variables, then rely on the resulting URI host for routing, allow-list checks, or forwarding decisions. In affected forwarding or gateway scenarios, this may cause requests or credentials to be sent to an unintended host. The issue is patched in `2.10.2`. `1.x` is end-of-life and will not receive a patch. Some workarounds are available. Validate the `Host` header as `uri-host [ &#34;:&#34; port ]` before calling `Message::parseRequest()` or legacy `parse_request()` on untrusted HTTP request data, or before deriving routing and forwarding decisions from a parsed request URI. Reject Host values containing userinfo, path, query, or fragment delimiters.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-48998 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3403 <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.</p> <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3403