Read the docs
TI-2022-13087 Aliases CVE-2022-31042GHSA-f2wf-25xc-69c9

Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle

Priority MEDIUM 43CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, or on making a request to a server which responds with a redirect to a a URI to a different host, we should not forward the `Cookie` header on. Prior to this fix, only cookies that were managed by our cookie middleware would be safely removed, and any `Cookie` header manually added to the initial request would not be stripped. We now always strip it, and allow the cookie middleware to re-add any cookies that it deems should be there. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. Users unable to upgrade may consider an alternative approach to use your own redirect middleware, rather than ours. If you do not require or expect redirects to be followed, one should simply disable redirects all together.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01992 80th percentileScored 2026-11-07
Fix Fixed guzzle (guzzle): 6.5.7, 7.4.4guzzlehttp/guzzle (Packagist): 6.5.7, 7.4.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
guzzleguzzlebefore 6.5.7; 7.0.0 to before 7.4.46.5.7, 7.4.4Patch availableCNA
—guzzlehttp/guzzle (Packagist)4.0.0 to before 6.5.76.5.7Patch availableGHSA-f2wf-25xc-69c9
—guzzlehttp/guzzle (Packagist)7.0.0 to before 7.4.47.4.4Patch availableGHSA-f2wf-25xc-69c9
  • guzzle Vendorguzzle Affected before 6.5.7; 7.0.0 to before 7.4.4 Fixed in 6.5.7, 7.4.4 Patch available CNA
  • guzzlehttp/guzzle (Packagist) Vendor— Affected 4.0.0 to before 6.5.7 Fixed in 6.5.7 Patch available GHSA-f2wf-25xc-69c9
  • guzzlehttp/guzzle (Packagist) Vendor— Affected 7.0.0 to before 7.4.4 Fixed in 7.4.4 Patch available GHSA-f2wf-25xc-69c9

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:guzzlephp:guzzle:*:*:*:*:*:*:*:*before 6.5.7; 7.0.0 to before 7.4.4Vulnerableguzzle
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*9.2.0 to before 9.2.21; 9.3.0 to before 9.3.16VulnerableDrupal
cpe:2.3:a:drupal:drupal:9.4.0:alpha1:*:*:*:*:*:*9.4.0 alpha1VulnerableDrupal
cpe:2.3:a:drupal:drupal:9.4.0:beta1:*:*:*:*:*:*9.4.0 beta1VulnerableDrupal
cpe:2.3:a:drupal:drupal:9.4.0:rc1:*:*:*:*:*:*9.4.0 rc1VulnerableDrupal
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:guzzlephp:guzzle:*:*:*:*:*:*:*:* Versions before 6.5.7; 7.0.0 to before 7.4.4 Vulnerable ·guzzle
  • cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* Versions 9.2.0 to before 9.2.21; 9.3.0 to before 9.3.16 Vulnerable ·Drupal
  • cpe:2.3:a:drupal:drupal:9.4.0:alpha1:*:*:*:*:*:* Versions 9.4.0 alpha1 Vulnerable ·Drupal
  • cpe:2.3:a:drupal:drupal:9.4.0:beta1:*:*:*:*:*:* Versions 9.4.0 beta1 Vulnerable ·Drupal
  • cpe:2.3:a:drupal:drupal:9.4.0:rc1:*:*:*:*:*:* Versions 9.4.0 rc1 Vulnerable ·Drupal
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · CNA guzzle (guzzle) Fixed in 6.5.7, 7.4.4
  • Fix · GHSA-f2wf-25xc-69c9 guzzlehttp/guzzle (Packagist) Fixed in 6.5.7 Advisory →
  • Fix · GHSA-f2wf-25xc-69c9 guzzlehttp/guzzle (Packagist) Fixed in 7.4.4 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31042
  2. 2026-10-03 Alias added: GHSA-f2wf-25xc-69c9

References

Patch 2

Advisory 4

Other 2

  • TI-2022-13088 Fix failure to strip Authorization header on HTTP downgrade in Guzzle CVSS 3.1HIGH 7.5
  • TI-2022-11789 Cross-domain cookie leakage in Guzzle CVSS 3.1HIGH 8.1
  • TI-2022-13135 Change in port should be considered a change in origin in Guzzle CVSS 3.1HIGH 7.7
  • TI-2022-13134 CURLOPT_HTTPAUTH option not cleared on change of origin in Guzzle CVSS 3.1HIGH 7.7
  • TI-2026-40256 Guzzle: Dot-Only Cookie Domains Match All Hosts in guzzlehttp/guzzle CVSS 3.1MEDIUM 5.8
  • TI-2026-42697 Guzzle: Cookie Disclosure and Injection via IP-Address Domains CVSS 3.1MEDIUM 6.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences