guzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure
Priority LOW 37CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as direct connections.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00372 31st percentileScored 2026-11-07
Fix Fixed guzzle (guzzle): 7.14.2guzzlehttp/guzzle (Packagist): 7.14.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| guzzle | guzzle | before 7.14.2 | 7.14.2 | Patch available | CNA |
| — | guzzlehttp/guzzle (Packagist) | before 7.14.2 | 7.14.2 | Patch available | GHSA-94pj-82f3-465w |
- guzzle Vendorguzzle Affected before 7.14.2 Fixed in 7.14.2 Patch available CNA
- guzzlehttp/guzzle (Packagist) Vendor— Affected before 7.14.2 Fixed in 7.14.2 Patch available GHSA-94pj-82f3-465w
Remediation
- Fix · CNA guzzle (guzzle) Fixed in 7.14.2
- Fix · GHSA-94pj-82f3-465w guzzlehttp/guzzle (Packagist) Fixed in 7.14.2 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-67339
- 2026-10-03 Alias added: GHSA-94pj-82f3-465w
References
Advisory 2
More guzzle vulnerabilities
- TI-2022-08589 Improper Input Validation in guzzlehttp/psr7 CVSS 3.1HIGH 7.5
- TI-2022-13088 Fix failure to strip Authorization header on HTTP downgrade in Guzzle CVSS 3.1HIGH 7.5
- TI-2022-13087 Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle CVSS 3.1HIGH 7.5
- TI-2023-13898 Laminas Diactoros vulnerable to HTTP Multiline Header Termination CVSS 3.1HIGH 7.5
- TI-2022-11789 Cross-domain cookie leakage in Guzzle CVSS 3.1HIGH 8.1
- TI-2026-48585 Guzzle: Noncanonical host can bypass host-based checks CVSS 3.1HIGH 7.2
Sources
- CVE-2026-67339 · CVE Program
- CVE-2026-67339 · NVD
- FIRST EPSS
- GHSA-94pj-82f3-465w · GitHub Advisory Database · CC BY 4.0
- CVE-2026-67339 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences