Guzzle: Three August 2026 Vulnerabilities Expose User Data and Credentials
Three vulnerabilities in Guzzle, disclosed on August 2, 2026, could lead to information disclosure and proxy credential theft in versions prior to 7.15.1 and 7.14.2.
Key findings
- Guzzle versions before 7.15.1 are affected by cookie scope and redirect referer vulnerabilities.
- CVE-2026-67339, affecting versions before 7.14.2, allows capture of proxy credentials.
- All disclosed vulnerabilities are related to information disclosure and potential credential leakage.
- Patched versions are 7.15.1 and 7.14.2, respectively. Users should update promptly.
On August 2, 2026, a batch of three vulnerabilities was disclosed for Guzzle, a popular PHP HTTP client. The vulnerabilities, all affecting versions prior to specific patch releases, center around the handling of cookies, redirect referers, and proxy authorization headers. These issues could potentially lead to information disclosure and the leakage of sensitive credentials.
One of the disclosed vulnerabilities, CVE-2026-67355, relates to how Guzzle handles host-only cookies. Versions before 7.15.1 incorrectly preserve the host-only cookie scope by storing the request host in the Domain field. This flaw allows attackers who control child hosts to receive host-only cookies that were intended only for parent hosts. Such a disclosure could lead to the exposure of session identifiers and authorization tokens.
Another vulnerability, CVE-2026-67354, also affecting versions before 7.15.1, involves an information disclosure within Guzzle's RedirectMiddleware. When the allow_redirects.referer setting is enabled, the middleware copies the URI fragment (the part of a URL after '#') from the referring request into the generated Referer header during redirects. This behavior could inadvertently expose sensitive information embedded in URL fragments.
The third vulnerability, CVE-2026-67339, impacts Guzzle versions prior to 7.14.2. It concerns the improper isolation of Proxy-Authorization headers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as direct connections. This could lead to the compromise of network access credentials.
All three vulnerabilities have been addressed in Guzzle. Versions 7.15.1 and later fix CVE-2026-67355 and CVE-2026-67354, while CVE-2026-67339 is resolved in versions 7.14.2 and later. Users are strongly advised to update to the patched versions to mitigate these security risks.
The coordinated disclosure of these three vulnerabilities highlights the importance of secure handling of sensitive data within HTTP clients. Developers relying on Guzzle should ensure their applications are updated to the latest versions to protect against potential information disclosure and credential theft. Continuous monitoring for security advisories related to widely used libraries like Guzzle is crucial for maintaining a robust security posture.