Intel

AIKIDO-2026-11089

guzzlehttp/psr7 is vulnerable to Denial of Service

Denial of Service Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published Today

53

Medium Risk

This Affects:

PHPguzzlehttp/psr7
2.0.0 - 2.10.3
Fixed in 2.10.4
Are you affected? Scan for Free

TL;DR

The CachingStream decorator wraps remote streams so previously read bytes can be replayed after seeking. Forward seek() could spin indefinitely when the remote stream was not at EOF but returned no data on each read, consuming CPU on the worker handling that stream. On read(), a cache target that persisted only part of a write was previously ignored, which could silently corrupt later replays from the cache. The patch stops no-progress seek loops and throws when the cache buffer cannot store the full read.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

guzzlehttp/psr7 is vulnerable to Denial of Service in versions 2.0.0 - 2.10.3.

How to fix this

Upgrade the guzzlehttp/psr7 library to the patch version.