Guzzle
Monthly
Host confusion in GuzzleHttp Guzzle before 7.15.2 and 8.0.1 allows remote attackers who can influence a fetched URI to bypass application-level host validation and reach network hosts the application intended to block, including loopback and internal addresses. The divergence occurs because PHP's filter_var() and Guzzle's own host checks operate on the literal URI text while libcurl independently percent-decodes and IDNA-maps the authority before resolving and connecting, meaning the application and transport disagree on which host is being contacted. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog, but any application that implements SSRF mitigations via URI host inspection before passing a user-supplied URL to Guzzle is directly undermined.
URI fragment leakage in guzzlehttp/guzzle's RedirectMiddleware (versions before 7.15.1) exposes sensitive client-side data to unintended redirect destinations when the non-default `allow_redirects.referer` option is explicitly enabled. An attacker who controls a same-scheme redirect target can harvest one-time login tokens, OAuth state values, or access tokens embedded in URI fragments from the Referer header included in the redirected request. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.2 with AC:H and AT:P accurately reflects the real-world complexity - exploitation requires three simultaneous non-trivial conditions to align.
Cookie scope leakage in guzzlehttp/guzzle before 7.15.1 allows an attacker controlling a child subdomain to receive host-only session cookies intended exclusively for the parent host. Guzzle's CookieJar incorrectly stores the originating request host in the cookie's Domain field rather than marking it host-only, causing ordinary domain-matching logic to forward the cookie to subdomains - exposing session identifiers and authorization tokens. No public exploit identified at time of analysis, but the CVSS 4.0 score of 8.2 reflects high confidentiality impact when the specific exploitation conditions are met.
Cookie domain scope bypass in Guzzle PHP HTTP client (prior to 7.15.2 and 8.0.1) allows improper cookie sharing via non-canonical IP address representations in cookie Domain attributes. The flaw in SetCookie::matchesDomain() fails to recognize hexadecimal (e.g., 0x7f000001), mixed-base octal (e.g., 0177.0.0.0x1), and percent-escaped (e.g., 192.168.0.%31) host spellings as IP literals, so cookies set for such domains incorrectly gain subdomain scope while libcurl resolves the same strings as actual IP addresses. This divergence enables an adversary-controlled host (e.g., evil.0x7f000001) to receive session cookies intended for the target IP, facilitating credential disclosure and session fixation; no public exploit identified at time of analysis.
Denial of service in guzzlehttp/guzzle versions before 7.15.1 allows a malicious or compromised upstream server to exhaust memory and break outbound requests by returning unlimited, oversized Set-Cookie headers. Guzzle's built-in CookieJar imposes no cap on cookie count or field size, so attacker-controlled cookies accumulate in memory and are later copied into a single outbound Cookie header that exceeds limits in handlers, proxies, or destination servers. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the cross-subdomain cookie scope (e.g., attacker.example.com poisoning cookies for service.example.com) extends the potential blast radius beyond the initially contacted server.
Proxy-Authorization header leakage in guzzlehttp/guzzle before 7.14.2 allows origin servers to receive proxy credentials due to a cURL handler misclassification bug. When requests are routed via SOCKS proxies, match no_proxy bypass rules, connect directly with proxying disabled, or cross proxy boundaries during redirects, Guzzle fails to migrate the Proxy-Authorization header from cURL's origin header list to the proxy-only channel - the credential arrives at the origin server instead of being confined to the proxy hop. An attacker who controls or monitors a destination origin server can harvest these credentials from access logs, then abuse the proxy to impersonate the proxy principal or reach destinations gated behind that proxy. No public exploit code has been identified at time of analysis.
Cookie domain suffix-matching bypass in Guzzle PHP HTTP client (prior to 7.12.3) allows cross-host cookie disclosure, cookie injection, and session fixation when an application makes requests to multiple IP-address-based or bare-numeric-domain hosts within a shared CookieJar session. The SetCookie::matchesDomain() method incorrectly applied suffix-matching logic - valid for FQDN hierarchies - to numeric domain identifiers such as 192.168.0.1, [::1], and bare labels like 1, meaning a cookie set by one numeric host could be forwarded to a structurally related but distinct host. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 7.12.3.
Host validation bypass in guzzlehttp/psr7 before 2.12.3 enables URI authority confusion attacks against PHP applications that rely on Uri::getHost() for security-critical decisions. The Uri::assertValidHost() method accepts host strings containing authority delimiters, embedded ports, or malformed IPv6 brackets, causing a semantic split where getHost() returns a sanitized value that disagrees with the actual URI authority used for routing - a classic CWE-436 interpretation conflict exploitable for SSRF allowlist bypass or host-based access control evasion. No public exploit has been identified at time of analysis; vendor-released patch version 2.12.3 resolves the issue.
CRLF injection in guzzlehttp/psr7 versions prior to 2.10.2 allows remote unauthenticated attackers to inject arbitrary HTTP headers into outbound requests by embedding carriage-return/line-feed sequences in a user-controlled URI host component. When a PSR-7 request is manually serialized into a raw HTTP/1.x message - for example via Message::toString() - the unvalidated host is copied verbatim into the Host header, enabling an attacker-supplied host like '"\r\nX-Injected: yes"' to append controlled headers to the serialized request. In deployments behind proxies, gateways, or load balancers with HTTP/1.1 connection reuse, this header injection can cascade into HTTP request smuggling or cache poisoning. No public exploit code has been identified at time of analysis, and exploitation through the standard Guzzle HTTP client API is explicitly not affected.
Host confusion in guzzlehttp/psr7 (all versions prior to 2.10.2) allows unauthenticated network attackers to supply a malformed Host header - such as `trusted.example@evil.example` - causing the library's URI construction logic to reinterpret the value as URI userinfo and a different host, silently replacing the parsed URI host with the attacker-controlled domain. Applications that rely on the resulting PSR-7 URI host for routing, allow-list enforcement, or forwarding decisions are at risk of sending requests and credentials to unintended destinations. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the conditional impact on forwarding gateways and API proxies built on psr7's server-request parsing functions is concrete.
Guzzle, an extensible PHP HTTP client. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Guzzle, an extensible PHP HTTP client. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Guzzle is an open source PHP HTTP client. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Guzzle is an open source PHP HTTP client. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Guzzle is a PHP HTTP client. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Host confusion in GuzzleHttp Guzzle before 7.15.2 and 8.0.1 allows remote attackers who can influence a fetched URI to bypass application-level host validation and reach network hosts the application intended to block, including loopback and internal addresses. The divergence occurs because PHP's filter_var() and Guzzle's own host checks operate on the literal URI text while libcurl independently percent-decodes and IDNA-maps the authority before resolving and connecting, meaning the application and transport disagree on which host is being contacted. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog, but any application that implements SSRF mitigations via URI host inspection before passing a user-supplied URL to Guzzle is directly undermined.
URI fragment leakage in guzzlehttp/guzzle's RedirectMiddleware (versions before 7.15.1) exposes sensitive client-side data to unintended redirect destinations when the non-default `allow_redirects.referer` option is explicitly enabled. An attacker who controls a same-scheme redirect target can harvest one-time login tokens, OAuth state values, or access tokens embedded in URI fragments from the Referer header included in the redirected request. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.2 with AC:H and AT:P accurately reflects the real-world complexity - exploitation requires three simultaneous non-trivial conditions to align.
Cookie scope leakage in guzzlehttp/guzzle before 7.15.1 allows an attacker controlling a child subdomain to receive host-only session cookies intended exclusively for the parent host. Guzzle's CookieJar incorrectly stores the originating request host in the cookie's Domain field rather than marking it host-only, causing ordinary domain-matching logic to forward the cookie to subdomains - exposing session identifiers and authorization tokens. No public exploit identified at time of analysis, but the CVSS 4.0 score of 8.2 reflects high confidentiality impact when the specific exploitation conditions are met.
Cookie domain scope bypass in Guzzle PHP HTTP client (prior to 7.15.2 and 8.0.1) allows improper cookie sharing via non-canonical IP address representations in cookie Domain attributes. The flaw in SetCookie::matchesDomain() fails to recognize hexadecimal (e.g., 0x7f000001), mixed-base octal (e.g., 0177.0.0.0x1), and percent-escaped (e.g., 192.168.0.%31) host spellings as IP literals, so cookies set for such domains incorrectly gain subdomain scope while libcurl resolves the same strings as actual IP addresses. This divergence enables an adversary-controlled host (e.g., evil.0x7f000001) to receive session cookies intended for the target IP, facilitating credential disclosure and session fixation; no public exploit identified at time of analysis.
Denial of service in guzzlehttp/guzzle versions before 7.15.1 allows a malicious or compromised upstream server to exhaust memory and break outbound requests by returning unlimited, oversized Set-Cookie headers. Guzzle's built-in CookieJar imposes no cap on cookie count or field size, so attacker-controlled cookies accumulate in memory and are later copied into a single outbound Cookie header that exceeds limits in handlers, proxies, or destination servers. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the cross-subdomain cookie scope (e.g., attacker.example.com poisoning cookies for service.example.com) extends the potential blast radius beyond the initially contacted server.
Proxy-Authorization header leakage in guzzlehttp/guzzle before 7.14.2 allows origin servers to receive proxy credentials due to a cURL handler misclassification bug. When requests are routed via SOCKS proxies, match no_proxy bypass rules, connect directly with proxying disabled, or cross proxy boundaries during redirects, Guzzle fails to migrate the Proxy-Authorization header from cURL's origin header list to the proxy-only channel - the credential arrives at the origin server instead of being confined to the proxy hop. An attacker who controls or monitors a destination origin server can harvest these credentials from access logs, then abuse the proxy to impersonate the proxy principal or reach destinations gated behind that proxy. No public exploit code has been identified at time of analysis.
Cookie domain suffix-matching bypass in Guzzle PHP HTTP client (prior to 7.12.3) allows cross-host cookie disclosure, cookie injection, and session fixation when an application makes requests to multiple IP-address-based or bare-numeric-domain hosts within a shared CookieJar session. The SetCookie::matchesDomain() method incorrectly applied suffix-matching logic - valid for FQDN hierarchies - to numeric domain identifiers such as 192.168.0.1, [::1], and bare labels like 1, meaning a cookie set by one numeric host could be forwarded to a structurally related but distinct host. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 7.12.3.
Host validation bypass in guzzlehttp/psr7 before 2.12.3 enables URI authority confusion attacks against PHP applications that rely on Uri::getHost() for security-critical decisions. The Uri::assertValidHost() method accepts host strings containing authority delimiters, embedded ports, or malformed IPv6 brackets, causing a semantic split where getHost() returns a sanitized value that disagrees with the actual URI authority used for routing - a classic CWE-436 interpretation conflict exploitable for SSRF allowlist bypass or host-based access control evasion. No public exploit has been identified at time of analysis; vendor-released patch version 2.12.3 resolves the issue.
CRLF injection in guzzlehttp/psr7 versions prior to 2.10.2 allows remote unauthenticated attackers to inject arbitrary HTTP headers into outbound requests by embedding carriage-return/line-feed sequences in a user-controlled URI host component. When a PSR-7 request is manually serialized into a raw HTTP/1.x message - for example via Message::toString() - the unvalidated host is copied verbatim into the Host header, enabling an attacker-supplied host like '"\r\nX-Injected: yes"' to append controlled headers to the serialized request. In deployments behind proxies, gateways, or load balancers with HTTP/1.1 connection reuse, this header injection can cascade into HTTP request smuggling or cache poisoning. No public exploit code has been identified at time of analysis, and exploitation through the standard Guzzle HTTP client API is explicitly not affected.
Host confusion in guzzlehttp/psr7 (all versions prior to 2.10.2) allows unauthenticated network attackers to supply a malformed Host header - such as `trusted.example@evil.example` - causing the library's URI construction logic to reinterpret the value as URI userinfo and a different host, silently replacing the parsed URI host with the attacker-controlled domain. Applications that rely on the resulting PSR-7 URI host for routing, allow-list enforcement, or forwarding decisions are at risk of sending requests and credentials to unintended destinations. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the conditional impact on forwarding gateways and API proxies built on psr7's server-request parsing functions is concrete.
Guzzle, an extensible PHP HTTP client. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Guzzle, an extensible PHP HTTP client. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Guzzle is an open source PHP HTTP client. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Guzzle is an open source PHP HTTP client. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Guzzle is a PHP HTTP client. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.