Read the docs
TI-2026-40109 Aliases CVE-2026-55568GHSA-wpwq-4j6v-78m3

Guzzle: Silent HTTPS-Proxy Downgrade to Cleartext

Priority LOW 25CWE-311Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-311.

Summary

Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in certain configurations, traffic expected to be protected by TLS on the hop to the proxy is transmitted in cleartext. Proxy authentication credentials (the Proxy-Authorization header, proxy userinfo in the proxy URL, or CURLOPT_PROXYUSERPWD) are sent without encryption, and the CONNECT target host and port for tunneled HTTPS requests are exposed. The built-in cURL handlers (GuzzleHttp\Handler\CurlHandler and GuzzleHttp\Handler\CurlMultiHandler, used by default whenever the PHP cURL extension is available) accept an https:// proxy. libcurl older than 7.50.2 silently treats an https:// proxy as a plaintext http:// proxy. The TLS connection to the proxy is never established, and the proxy leg is cleartext with no error or warning. An application is affected when it sends requests through one of the built-in cURL handlers, configures an https:// proxy expecting the proxy connection itself to be encrypted, and runs with libcurl older than 7.50.2. This vulnerability is fixed in 7.12.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00148 4th percentileScored 2026-11-07
Fix Fixed guzzle (guzzle): 7.12.1guzzlehttp/guzzle (Packagist): 7.12.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
guzzleguzzlebefore 7.12.17.12.1Patch availableCNA
—guzzlehttp/guzzle (Packagist)before 7.12.17.12.1Patch availableGHSA-wpwq-4j6v-78m3
  • guzzle Vendorguzzle Affected before 7.12.1 Fixed in 7.12.1 Patch available CNA
  • guzzlehttp/guzzle (Packagist) Vendor— Affected before 7.12.1 Fixed in 7.12.1 Patch available GHSA-wpwq-4j6v-78m3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:guzzlephp:guzzle:*:*:*:*:*:*:*:*before 7.12.1Vulnerableguzzle
  • cpe:2.3:a:guzzlephp:guzzle:*:*:*:*:*:*:*:* Versions before 7.12.1 Vulnerable ·guzzle

Remediation

  • Fix · CNA guzzle (guzzle) Fixed in 7.12.1
  • Fix · GHSA-wpwq-4j6v-78m3 guzzlehttp/guzzle (Packagist) Fixed in 7.12.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55568
  2. 2026-10-03 Alias added: GHSA-wpwq-4j6v-78m3

References

Advisory 1

Other 1

  • TI-2022-13088 Fix failure to strip Authorization header on HTTP downgrade in Guzzle CVSS 3.1HIGH 7.5
  • TI-2022-13087 Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle CVSS 3.1HIGH 7.5
  • TI-2022-11789 Cross-domain cookie leakage in Guzzle CVSS 3.1HIGH 8.1
  • TI-2022-13135 Change in port should be considered a change in origin in Guzzle CVSS 3.1HIGH 7.7
  • TI-2022-13134 CURLOPT_HTTPAUTH option not cleared on change of origin in Guzzle CVSS 3.1HIGH 7.7
  • TI-2026-40256 Guzzle: Dot-Only Cookie Domains Match All Hosts in guzzlehttp/guzzle CVSS 3.1MEDIUM 5.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences