Vulnerabilities

TI-2026-48585 CVE-2026-69246 · GHSA-v5mv-p594-2x33

Guzzle: Noncanonical host can bypass host-based checks

LOW 38

Guzzle is an extensible PHP HTTP client.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.0037 Published 2026-08-03 Fixed in 8.0.1, 7.15.2 CWE-180

TI-2026-48584 CVE-2026-69245 · GHSA-f7vp-7xgx-4w4r

Guzzle: Noncanonical cookie domain keeps subdomain scope

LOW 34

Guzzle is an extensible PHP HTTP client.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00199 Published 2026-08-03 Fixed in 7.15.2, 8.0.1 CWE-180

TI-2026-47650 CVE-2026-67354 · GHSA-h95v-h523-3mw8

guzzlehttp/guzzle before 7.15.1 URI Fragment Disclosure via Referer

LOW 36

guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00372 Published 2026-08-01 Fixed in 7.15.1 CWE-201

TI-2026-47651 CVE-2026-67355 · GHSA-wm3w-8rrp-j577

guzzlehttp/guzzle before 7.15.1 Host-only Cookie Scope

LOW 36

guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00366 Published 2026-08-01 Fixed in 7.15.1 CWE-201

TI-2026-47649 CVE-2026-67353 · GHSA-f283-ghqc-fg79

guzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of Service

LOW 37

guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00418 Published 2026-08-01 Fixed in 7.15.1 CWE-770

TI-2026-47635 CVE-2026-67339 · GHSA-94pj-82f3-465w

guzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure

LOW 37

guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00372 Published 2026-08-01 Fixed in 7.14.2 CWE-200

TI-2026-42697 CVE-2026-59883 · GHSA-g446-98w2-8p5w

Guzzle: Cookie Disclosure and Injection via IP-Address Domains

LOW 26

Guzzle is an extensible PHP HTTP client.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00167 Published 2026-07-08 Fixed in 7.12.3 CWE-346

TI-2026-42696 CVE-2026-59882 · GHSA-c2w2-prh8-qm98

guzzlehttp/psr7: Host Confusion via Weak URI Host Validation

LOW 29

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00317 Published 2026-07-08 Fixed in 2.12.3 CWE-436

TI-2026-40255 CVE-2026-55766 · GHSA-vm85-hxw5-5432

guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization

LOW 21

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00229 Published 2026-06-23 Fixed in 2.12.1 CWE-113

TI-2026-40256 CVE-2026-55767 · GHSA-cwxw-98qj-8qjx

Guzzle: Dot-Only Cookie Domains Match All Hosts in guzzlehttp/guzzle

LOW 31

Guzzle is an extensible PHP HTTP client.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00211 Published 2026-06-23 Fixed in 7.12.1 CWE-1286

TI-2026-40109 CVE-2026-55568 · GHSA-wpwq-4j6v-78m3

Guzzle: Silent HTTPS-Proxy Downgrade to Cleartext

LOW 25

Guzzle is an extensible PHP HTTP client.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00148 Published 2026-06-23 Fixed in 7.12.1 CWE-311

TI-2026-38743 CVE-2026-53723 · GHSA-q8r6-5hfw-5jff

guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator

LOW 31

Guzzle Services provides an implementation of the Guzzle Command library that uses Guzzle service descriptions to describe web services, serialize requests, and parse responses into easy to use model structures.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00219 Published 2026-06-11 Fixed in 1.5.4 CWE-20

TI-2026-36415 CVE-2026-49214 · GHSA-hq7v-mx3g-29hw

guzzlehttp/psr7 has CRLF Injection via URI Host Component

LOW 29

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0019 Published 2026-06-11 Fixed in 2.10.2 CWE-113

TI-2026-36252 CVE-2026-48998 · GHSA-34xg-wgjx-8xph

guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation

LOW 29

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00198 Published 2026-06-11 Fixed in 2.10.2 CWE-20

TI-2025-15577 CVE-2025-21617 · GHSA-237r-r8m4-4q88

Guzzle OAuth Subscriber has insufficient nonce entropy

LOW 29

Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00479 Published 2025-01-06 Fixed in 0.8.1 CWE-338

TI-2023-13898 CVE-2023-29530 · GHSA-xv3h-4844-9h36

Laminas Diactoros vulnerable to HTTP Multiline Header Termination

MEDIUM 41

Laminas Diactoros provides PSR HTTP Message implementations.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00965 Published 2023-04-24 Fixed in 2.18.1, 2.19.1 +6 CWE-20

TI-2023-13625 CVE-2023-29197 · GHSA-wxmh-65f7-jcvw

Improper header name validation in guzzlehttp/psr7

LOW 35

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01216 Published 2023-04-17 Fixed in 1.9.1, 2.4.5 CWE-436

TI-2022-13135 CVE-2022-31091 · GHSA-q559-8m2m-g699

Change in port should be considered a change in origin in Guzzle

LOW 37

Guzzle, an extensible PHP HTTP client.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01565 Published 2022-06-27 Fixed in 6.5.8, 7.4.5 CWE-200

TI-2022-13134 CVE-2022-31090 · GHSA-25mq-v84q-4j7r

CURLOPT_HTTPAUTH option not cleared on change of origin in Guzzle

LOW 37

Guzzle, an extensible PHP HTTP client.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01916 Published 2022-06-27 Fixed in 6.5.8, 7.4.5 CWE-200

TI-2022-13088 CVE-2022-31043 · GHSA-w248-ffj2-4v5q

Fix failure to strip Authorization header on HTTP downgrade in Guzzle

MEDIUM 43

Guzzle is an open source PHP HTTP client.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01992 Published 2022-06-09 Fixed in 6.5.7, 7.4.4 CWE-200

TI-2022-13087 CVE-2022-31042 · GHSA-f2wf-25xc-69c9

Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle

MEDIUM 43

Guzzle is an open source PHP HTTP client.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01992 Published 2022-06-09 Fixed in 6.5.7, 7.4.4 CWE-200

TI-2022-11789 CVE-2022-29248 · GHSA-cwmx-hcrq-mhc3

Cross-domain cookie leakage in Guzzle

MEDIUM 40

Guzzle is a PHP HTTP client.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.01351 Published 2022-05-25 Fixed in 6.5.6, 7.4.3 CWE-200

TI-2022-08589 CVE-2022-24775 · GHSA-q7rv-6hp3-vh96

Improper Input Validation in guzzlehttp/psr7

MEDIUM 44

guzzlehttp/psr7 is a PSR-7 HTTP message library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0248 Published 2022-03-21 Fixed in 1.8.4, 2.1.1 CWE-20

Vulnerabilities

Filters