By vendor

Guzzlephp vulnerabilities

Known CVEs affecting Guzzlephp products, prioritized by severity, with SEC.co remediation and detection guidance.

7 published vulnerabilities

• CVE-2026-55568MEDIUM 5.9

  Guzzle, a widely-used PHP HTTP client library, contains a flaw that causes proxy credentials and encrypted connection metadata to be transmitted unencrypted under specific conditions. When an application configures an HTTPS proxy expecting end-to-end encryption to that proxy, older versions of the underlying libcurl library (prior to 7.50.2) silently downgrade the connection to plain HTTP instead of raising an error. This means proxy usernames, passwords, and the details of HTTPS requests being tunneled through the proxy are exposed in cleartext on the network. The vulnerability only affects applications using Guzzle's built-in cURL handlers (the default) with https:// proxy configurations and outdated libcurl versions.

• CVE-2026-55767MEDIUM 5.8

  Guzzle, a popular PHP HTTP client library, has a flaw in how it validates cookie attributes. The library incorrectly permits cookies with a domain attribute that is either completely empty or contains only whitespace, after normalization. When an attacker-controlled web server sets such a malformed cookie, Guzzle stores it and then sends it to any downstream host that the application requests using the same cookie jar—regardless of domain matching rules. This cookie injection could be leveraged for session fixation or other cookie-based attacks against services downstream from the vulnerable application.

• CVE-2026-48998MEDIUM 5.3

  A library used by PHP developers to handle HTTP messages (guzzlehttp/psr7) has a flaw in how it validates the Host header when processing HTTP requests. An attacker can craft a malicious Host header that tricks the library into misidentifying which server the request is intended for. For example, an attacker could use a Host header like `[email protected]` which the library might interpret as being meant for `evil.example` rather than `trusted.example`. This matters most if your application relies on the Host header to decide where to route requests or whether to trust them. In worst-case scenarios—particularly for API gateways, proxies, or request forwarding services—this could lead to sensitive requests or credentials being sent to an attacker's server instead of the intended destination.

• CVE-2026-49214MEDIUM 5.3

  guzzlehttp/psr7 versions before 2.10.2 fail to sanitize special characters in user-supplied URLs, allowing attackers to inject additional HTTP headers into outbound requests. If your application constructs HTTP requests from untrusted URLs—such as user input, forwarded requests, or webhook destinations—an attacker can craft a malicious URL that breaks out of the host parameter and injects fake headers like `X-Injected: yes`. This becomes especially dangerous when requests are relayed through proxies or load balancers, where the malformed headers can poison caches or trigger request smuggling attacks.

• CVE-2026-55766MEDIUM 4.8

  guzzlehttp/psr7, a widely-used PHP library for handling HTTP messages, fails to properly sanitize certain HTTP protocol fields when processing attacker-controlled input. Specifically, carriage return and line feed (CR/LF) characters are not rejected in the request method, protocol version, and response reason phrase. If an application accepts untrusted data and uses psr7 to serialize messages for network transmission, an attacker could inject additional HTTP headers into the serialized output, potentially bypassing security controls or manipulating message intent. The vulnerability requires deliberate serialization to HTTP/1.x format; simply creating or modifying a PSR-7 object is not exploitable on its own.

• CVE-2026-59883MEDIUM 4.7

  Guzzle, a widely-used PHP HTTP client library, contains a cookie-handling flaw that can allow attackers to leak cookies between different hosts or inject cookies into requests. The vulnerability exists in how Guzzle's CookieJar component validates which domains a cookie belongs to. When a cookie is scoped to an IP address (like 192.168.0.1 or ::1) or a bare numeric value, Guzzle incorrectly applies standard domain suffix matching rules instead of requiring an exact match. This means a cookie set for one IP could be sent to a different IP on the same network, or a cookie meant for one host could be injected into requests to another. The issue affects Guzzle versions prior to 7.12.3 and requires user interaction to exploit (such as visiting a malicious page), but can impact any application using vulnerable Guzzle versions.

• CVE-2026-59882MEDIUM 4.2

  A flaw in guzzlehttp/psr7 (a widely-used PHP HTTP message library) allows attackers to craft URIs with specially-formatted host components that bypass validation. The library's host validation function fails to catch authority delimiters, embedded ports, or malformed IPv6 brackets, creating a disconnect between what the library reports as the host and what the URI actually specifies. This mismatch can confuse security checks or routing logic that rely on the reported host value.