{"items":[{"id":"NVI-00002178","kind":"vulnerability","title":"guzzlehttp/psr7 has CRLF Injection via URI Host Component","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-hq7v-mx3g-29hw","CVE-2026-49214"],"plain_summary":"OSV carries this publisher advisory for guzzlehttp/psr7. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 2.10.2 for guzzlehttp/psr7. Confirm the publisher’s latest guidance.","source_ids":["sr-0e8064ca2d0c094f7830aa5135884999"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-10c28ab36f864d98cc68ddee3f46d0c3"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-11-03T12:00:27.000Z","value":"0.190%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.08689. Missing scores are unknown.","source_id":"sr-10c28ab36f864d98cc68ddee3f46d0c3"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-0e8064ca2d0c094f7830aa5135884999","url":"https://github.com/advisories/GHSA-hq7v-mx3g-29hw","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-hq7v-mx3g-29hw","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:20.431Z"},{"id":"sr-10c28ab36f864d98cc68ddee3f46d0c3","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-49214","publisher":"FIRST EPSS","observed_at":"2026-11-03T17:44:07.786Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-0e8064ca2d0c094f7830aa5135884999"],"technology":"guzzlehttp/psr7","known_exclusions":[],"conditions_summary":"## Impact\n\n`guzzlehttp/psr7` did not reject ASCII control characters, whitespace, or DEL in first-party URI host components. The issue requires a PSR-7 request to be serialized into a raw HTTP/1.x message, for example with `GuzzleHttp\\Psr7\\Message::toString()` or an equivalent custom serializer. Creating a `Uri`, `Request`, or other PSR-7 object alone is not sufficient. The malformed host must be copied into the serialized `Host` header without further validation.\n\nA vulnerable flow is:\n\n1. An application accepts a user-controlled URL.\n2. The URL is used to construct a PSR-7 `Uri` or `Request`.\n3. The host component contains CRLF or another header-unsafe character.\n4. The request is serialized into a raw HTTP/1.x message without an explicit `Host` header.\n5. The host is copied into the serialized `Host` header.\n6. The serialized request is written to the network or otherwise processed by software that does not independently reject the malformed host.\n\nIn that flow, an attacker can cause the serialized request to contain additional attacker-controlled header lines. For example, a host containing `\"\\r\\nX-Injected: yes\"` can cause the generated `Host` header to span multiple HTTP head","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 2.10.2"]}],"null_published_at":"2026-11-06T00:29:57.292Z","source_updated_at":"2026-09-10T03:50:49.920Z","source_disclosed_at":"2026-06-11T13:04:47.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:42:20.431Z"},{"id":"NVI-00002178","kind":"vulnerability","title":"guzzlehttp/psr7 has CRLF Injection via URI Host Component","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-hq7v-mx3g-29hw","CVE-2026-49214"],"plain_summary":"OSV carries this publisher advisory for guzzlehttp/psr7. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 2.10.2 for guzzlehttp/psr7. Confirm the publisher’s latest guidance.","source_ids":["sr-0e8064ca2d0c094f7830aa5135884999"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-0e8064ca2d0c094f7830aa5135884999","url":"https://github.com/advisories/GHSA-hq7v-mx3g-29hw","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-hq7v-mx3g-29hw","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:20.431Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-0e8064ca2d0c094f7830aa5135884999"],"technology":"guzzlehttp/psr7","known_exclusions":[],"conditions_summary":"## Impact\n\n`guzzlehttp/psr7` did not reject ASCII control characters, whitespace, or DEL in first-party URI host components. The issue requires a PSR-7 request to be serialized into a raw HTTP/1.x message, for example with `GuzzleHttp\\Psr7\\Message::toString()` or an equivalent custom serializer. Creating a `Uri`, `Request`, or other PSR-7 object alone is not sufficient. The malformed host must be copied into the serialized `Host` header without further validation.\n\nA vulnerable flow is:\n\n1. An application accepts a user-controlled URL.\n2. The URL is used to construct a PSR-7 `Uri` or `Request`.\n3. The host component contains CRLF or another header-unsafe character.\n4. The request is serialized into a raw HTTP/1.x message without an explicit `Host` header.\n5. The host is copied into the serialized `Host` header.\n6. The serialized request is written to the network or otherwise processed by software that does not independently reject the malformed host.\n\nIn that flow, an attacker can cause the serialized request to contain additional attacker-controlled header lines. For example, a host containing `\"\\r\\nX-Injected: yes\"` can cause the generated `Host` header to span multiple HTTP head","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 2.10.2"]}],"null_published_at":"2026-10-31T21:54:04.900Z","source_updated_at":"2026-09-10T03:50:49.920Z","source_disclosed_at":"2026-06-11T13:04:47.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:20.431Z"}],"next_cursor":null,"snapshot_revision":"42594"}