Uri::assertValidHost() in guzzle:psr7 versions older than 2.12.3 fails to reject host components that contain authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to return a host that differs from the URI authority. This mismatch—representing a Host Confusion flaw (CWE‑436)—can lead to host confusion attacks that cause requests to be routed to unintended destinations or bypass host‑based access controls.

All installations of guzzle:psr7 earlier than version 2.12.3 are affected. Any PHP application that depends on the library—directly or indirectly—is at risk; the issue pertains only to the URI parsing functionality.

Based on the description, it is inferred that attackers can supply a crafted URI that passes validation but contains a conflicting host, typically through user input or manipulated data sources. The CVSS score of 4.2 indicates moderate severity; EPSS is reported as <1%, and the vulnerability is not listed in CISA KEV. While the likelihood of exploitation appears low, the impact of misrouting or improper access control could compromise confidentiality or integrity in systems that depend heavily on the host value for security decisions.