EUVD-2026-51854
GHSA-32rq-jhr7-m3hh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because triggering the leak requires non-default routing conditions (SOCKS proxy, no_proxy match, or redirect across proxy boundary); C:L for proxy credential disclosure only.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as direct connections.
AnalysisAI
Proxy-Authorization header leakage in guzzlehttp/guzzle before 7.14.2 allows origin servers to receive proxy credentials due to a cURL handler misclassification bug. When requests are routed via SOCKS proxies, match no_proxy bypass rules, connect directly with proxying disabled, or cross proxy boundaries during redirects, Guzzle fails to migrate the Proxy-Authorization header from cURL's origin header list to the proxy-only channel - the credential arrives at the origin server instead of being confined to the proxy hop. An attacker who controls or monitors a destination origin server can harvest these credentials from access logs, then abuse the proxy to impersonate the proxy principal or reach destinations gated behind that proxy. No public exploit code has been identified at time of analysis.
Technical ContextAI
Guzzle's CurlHandler and CurlMultiHandler (the default HTTP transport when PHP's cURL extension is installed) build the outgoing request by placing all first-class PSR-7 headers into cURL's CURLOPT_HTTPHEADER option - the origin header list. The library's intended design moves Proxy-Authorization to cURL's CURLOPT_PROXYHEADER option (the proxy-only channel) only when Guzzle's own routing logic predicts an HTTP or HTTPS proxy will be used. This prediction diverges from the route libcurl actually takes in four cases: direct connections, no_proxy/NO_PROXY rule matches, SOCKS proxies (which do not use the HTTP proxy header channel at all), and cross-origin redirects where redirect middleware re-evaluates the proxy per hop but - unlike Authorization and Cookie - does not strip Proxy-Authorization. On installations where libcurl is older than 7.37.0 or the PHP cURL extension lacks CURLOPT_PROXYHEADER and CURLHEADER_SEPARATE support, no proxy-only channel is available and the credential leaks on every route. The stream handler serialized first-class headers before proxy selection, introducing a parallel disclosure path. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) accurately captures the root cause: the credential, scoped by RFC 9110 to the next inbound proxy only, is transmitted to an unintended recipient. CPE cpe:2.3:a:guzzle:guzzle:*:*:*:*:*:*:*:* covers all Guzzle releases; the fix is in composer package guzzlehttp/guzzle 7.14.2.
RemediationAI
Upgrade guzzlehttp/guzzle to version 7.14.2 or later via Composer: run 'composer require guzzlehttp/guzzle:^7.14.2'. This is the vendor-confirmed fixed release as documented in the GitHub security advisory GHSA-94pj-82f3-465w and the upstream commit at https://github.com/guzzle/guzzle/commit/9e4580d4b9981e903dc6323fe37f50a96e85b05e (PR #3876). If immediate upgrade is blocked, three compensating controls can reduce exposure: first, avoid passing Proxy-Authorization as a first-class PSR-7 request header - instead supply proxy credentials exclusively through cURL's raw CURLOPT_PROXYUSERPWD option, bypassing the affected code path entirely (trade-off: requires lower-level cURL configuration and cannot be set via Guzzle's standard header API); second, disable redirect following (RequestOptions::ALLOW_REDIRECTS => false) where Proxy-Authorization is in use, which eliminates the cross-origin redirect disclosure vector (trade-off: breaks any workflow relying on HTTP redirects); third, rotate any Proxy-Authorization credentials that may have been exposed to origin servers, particularly if access logs on destination servers are accessible to third parties. Detailed guidance is available at https://github.com/guzzle/guzzle/security/advisories/GHSA-94pj-82f3-465w.
Host confusion in GuzzleHttp Guzzle before 7.15.2 and 8.0.1 allows remote attackers who can influence a fetched URI to b
Cookie domain scope bypass in Guzzle PHP HTTP client (prior to 7.15.2 and 8.0.1) allows improper cookie sharing via non-
URI fragment leakage in guzzlehttp/guzzle's RedirectMiddleware (versions before 7.15.1) exposes sensitive client-side da
Cookie scope leakage in guzzlehttp/guzzle before 7.15.1 allows an attacker controlling a child subdomain to receive host
Guzzle is a PHP HTTP client. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authenticati
Guzzle, an extensible PHP HTTP client. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low a
Guzzle, an extensible PHP HTTP client. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low a
Guzzle is an open source PHP HTTP client. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no
Guzzle is an open source PHP HTTP client. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no
Denial of service in guzzlehttp/guzzle versions before 7.15.1 allows a malicious or compromised upstream server to exhau
Host validation bypass in guzzlehttp/psr7 before 2.12.3 enables URI authority confusion attacks against PHP applications
Cookie domain suffix-matching bypass in Guzzle PHP HTTP client (prior to 7.12.3) allows cross-host cookie disclosure, co
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today