Read the docs
TI-2022-13088 Aliases CVE-2022-31043GHSA-w248-ffj2-4v5q

Fix failure to strip Authorization header on HTTP downgrade in Guzzle

Priority MEDIUM 43CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-863.

Summary

Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, we should not forward the `Authorization` header on. This is much the same as to how we don't forward on the header if the host changes. Prior to this fix, `https` to `http` downgrades did not result in the `Authorization` header being removed, only changes to the host. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. Users unable to upgrade may consider an alternative approach which would be to use their own redirect middleware. Alternately users may simply disable redirects all together if redirects are not expected or required.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01992 80th percentileScored 2026-11-07
Fix Fixed guzzle (guzzle): 6.5.7, 7.4.4guzzlehttp/guzzle (Packagist): 6.5.7, 7.4.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
guzzleguzzlebefore 6.5.7; 7.0.0 to before 7.4.46.5.7, 7.4.4Patch availableCNA
—guzzlehttp/guzzle (Packagist)4.0.0 to before 6.5.76.5.7Patch availableGHSA-w248-ffj2-4v5q
—guzzlehttp/guzzle (Packagist)7.0.0 to before 7.4.47.4.4Patch availableGHSA-w248-ffj2-4v5q
  • guzzle Vendorguzzle Affected before 6.5.7; 7.0.0 to before 7.4.4 Fixed in 6.5.7, 7.4.4 Patch available CNA
  • guzzlehttp/guzzle (Packagist) Vendor— Affected 4.0.0 to before 6.5.7 Fixed in 6.5.7 Patch available GHSA-w248-ffj2-4v5q
  • guzzlehttp/guzzle (Packagist) Vendor— Affected 7.0.0 to before 7.4.4 Fixed in 7.4.4 Patch available GHSA-w248-ffj2-4v5q

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:guzzlephp:guzzle:*:*:*:*:*:*:*:*before 6.5.7; 7.0.0 to before 7.4.4Vulnerableguzzle
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*9.2.0 to before 9.2.21; 9.3.0 to before 9.3.16VulnerableDrupal
cpe:2.3:a:drupal:drupal:9.4.0:alpha1:*:*:*:*:*:*9.4.0 alpha1VulnerableDrupal
cpe:2.3:a:drupal:drupal:9.4.0:beta1:*:*:*:*:*:*9.4.0 beta1VulnerableDrupal
cpe:2.3:a:drupal:drupal:9.4.0:rc1:*:*:*:*:*:*9.4.0 rc1VulnerableDrupal
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:guzzlephp:guzzle:*:*:*:*:*:*:*:* Versions before 6.5.7; 7.0.0 to before 7.4.4 Vulnerable ·guzzle
  • cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* Versions 9.2.0 to before 9.2.21; 9.3.0 to before 9.3.16 Vulnerable ·Drupal
  • cpe:2.3:a:drupal:drupal:9.4.0:alpha1:*:*:*:*:*:* Versions 9.4.0 alpha1 Vulnerable ·Drupal
  • cpe:2.3:a:drupal:drupal:9.4.0:beta1:*:*:*:*:*:* Versions 9.4.0 beta1 Vulnerable ·Drupal
  • cpe:2.3:a:drupal:drupal:9.4.0:rc1:*:*:*:*:*:* Versions 9.4.0 rc1 Vulnerable ·Drupal
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · CNA guzzle (guzzle) Fixed in 6.5.7, 7.4.4
  • Fix · GHSA-w248-ffj2-4v5q guzzlehttp/guzzle (Packagist) Fixed in 6.5.7 Advisory →
  • Fix · GHSA-w248-ffj2-4v5q guzzlehttp/guzzle (Packagist) Fixed in 7.4.4 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31043
  2. 2026-10-03 Alias added: GHSA-w248-ffj2-4v5q

References

Patch 2

Advisory 4

Other 2

  • TI-2022-13087 Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle CVSS 3.1HIGH 7.5
  • TI-2022-11789 Cross-domain cookie leakage in Guzzle CVSS 3.1HIGH 8.1
  • TI-2022-13135 Change in port should be considered a change in origin in Guzzle CVSS 3.1HIGH 7.7
  • TI-2022-13134 CURLOPT_HTTPAUTH option not cleared on change of origin in Guzzle CVSS 3.1HIGH 7.7
  • TI-2026-40256 Guzzle: Dot-Only Cookie Domains Match All Hosts in guzzlehttp/guzzle CVSS 3.1MEDIUM 5.8
  • TI-2026-42697 Guzzle: Cookie Disclosure and Injection via IP-Address Domains CVSS 3.1MEDIUM 6.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences