[GHSA] GHSA-v5mv-p594-2x33 (high) — Guzzle: Noncanonical host can bypass host-based checks

GHSA-v5mv-p594-2x33 Severity: high CVE: CVE-2026-69246

Guzzle: Noncanonical host can bypass host-based checks

### Impact

In affected versions, Guzzle gives a transport the request URI as text and supplies the `Host` header separately. The cURL handlers set `CURLOPT_URL` to the URI exactly as written and push that `Host` into `CURLOPT_HTTPHEADER`; `StreamHandler` does the same through `fopen()`.