Guzzle security advisories

All Guzzle advisories

23 advisories, newest first.

• high Guzzle · Aug 3, 2026 · Reviewed Nov 1

  Guzzle: Oddly Written Hosts Can Slip Past Host-Based Checks

  Lets an attacker reach hosts an app meant to block, such as loopback, when the app builds Guzzle request URLs from user input and checks the host first.

  Fixed in 8.0.1 and 7.15.2

• medium Guzzle · Aug 3, 2026 · Reviewed Nov 2

  Guzzle: Cookies for Numeric or Escaped Domains Leak to Other Hosts

  Can leak cookies set for an IP-style Domain to other hosts in apps that use Guzzle's cookie jar, exposing session ids or tokens.

  Fixed in 8.0.1 and 7.15.2

• medium Guzzle · Jul 21, 2026 · Reviewed Nov 2

  guzzlehttp/psr7: Malformed URI Hosts Can Fool Host Checks

  Lets an attacker get past host allowlists or SSRF checks in apps that build a psr7 Uri from user input and trust getHost().

  Fixed in 2.12.3

• medium Guzzle · Jul 20, 2026 · Reviewed Nov 2

  Guzzle: Redirects Can Leak URL Fragments in the Referer Header

  Can leak secrets kept in a URL fragment to a redirect target, in apps that turn on Guzzle's referer redirect option.

  Fixed in 7.15.1

• medium Guzzle · Jul 20, 2026 · Reviewed Nov 2

  Guzzle: Host-Only Cookies Are Sent to Subdomains

  Can send a parent host's session cookies to its subdomains in apps that reuse one Guzzle cookie jar across hosts.

  Fixed in 7.15.1

• medium Guzzle · Jul 20, 2026 · Reviewed Nov 2

  Guzzle: Malicious Server Can Flood the Cookie Jar

  Lets a malicious server fill Guzzle's cookie jar with large cookies, using memory and breaking later requests that share the jar.

  Fixed in 7.15.1

• medium Guzzle · Jul 20, 2026 · Reviewed Nov 3

  Guzzle: Cookies Set for IP Addresses Leak to Look-Alike Hosts

  Can send cookies scoped to an IP address to other hosts, or let those hosts plant cookies, in apps that use Guzzle's cookie jar.

  Fixed in 7.12.3

• medium Guzzle · Jul 20, 2026 · Reviewed Nov 3

  Guzzle: Proxy Credentials Can Be Sent to the Destination Server

  Can send Proxy-Authorization credentials to the target server when a request skips the HTTP proxy, with Guzzle's cURL handlers.

  Fixed in 7.14.2

• medium Guzzle · Jun 18, 2026 · Reviewed Nov 7

  Guzzle: Cookies With a Dot-Only Domain Are Sent to Every Host

  Lets a malicious server plant a cookie that Guzzle then sends to every other host using the same cookie jar.

  Fixed in 7.12.1

• medium Guzzle · Jun 18, 2026 · Reviewed Nov 4

  Guzzle: HTTPS Proxy Silently Falls Back to Cleartext on Old libcurl

  Can send proxy traffic unencrypted when Guzzle is set to use an https:// proxy and the server's libcurl is older than 7.50.2.

  Fixed in 7.12.1

• medium Guzzle · Jun 18, 2026 · Reviewed Nov 7

  guzzlehttp/psr7: Header Injection Through the Method or Reason Phrase

  Lets an attacker inject HTTP headers when an app puts user input in a psr7 method, protocol or reason phrase and serializes the message.

  Fixed in 2.12.1

• medium Guzzle · Jun 2, 2026 · Reviewed Nov 2

  Guzzle Services: XML Injection in Outgoing Request Bodies

  Lets user input add XML markup to request bodies in apps that use guzzle-services to send XML built from that input.

  Fixed in 1.5.4

• medium Guzzle · May 25, 2026 · Reviewed Nov 3

  guzzlehttp/psr7: Crafted Host Header Changes the Request's Host

  Lets an attacker make an incoming request's URI host differ from its Host header in apps that build server requests with guzzlehttp/psr7.

  Fixed in 2.10.2

• medium Guzzle · May 25, 2026 · Reviewed Nov 3

  guzzlehttp/psr7: Header Injection Through the URI Host

  Lets an attacker inject HTTP headers when an app builds a psr7 request from a user URL and serializes it as raw HTTP.

  Fixed in 2.10.2

• medium Guzzle · Jan 6, 2025 · Reviewed Nov 8

  Guzzle OAuth Subscriber: Weak Nonces Can Allow Replayed OAuth 1 Requests

  Generates weak OAuth 1 nonces, which can leave the servers your app calls open to replayed requests when the connection doesn't use TLS.

  Fixed in 0.8.1

• medium Guzzle · Apr 17, 2023

  Improper header validation

  Fixed in 2.4.5 and 1.9.1

• high Guzzle · Jun 20, 2022

  CURLOPT_HTTPAUTH option not cleared on change of origin

  Fixed in 7.4.5 and 6.5.8

• high Guzzle · Jun 20, 2022

  Change in port should be considered a change in origin

  Fixed in 7.4.5 and 6.5.8

• high Guzzle · Jun 9, 2022

  Failure to strip the Cookie header on change in host or HTTP downgrade

  Fixed in 7.4.4 and 6.5.7

• high Guzzle · Jun 9, 2022

  Fix failure to strip Authorization header on HTTP downgrade

  Fixed in 7.4.4 and 6.5.7

• high Guzzle · May 25, 2022

  Cross-domain cookie leakage

  Fixed in 7.4.3 and 6.5.6

• medium Guzzle · Mar 20, 2022

  Inproper parsing of HTTP headers

  Fixed in 2.1.1 and 1.8.4

• high Guzzle · Jul 15, 2016

  HTTP Proxy header vulnerability

  Fixed in 8.1.7, 6.2.1 and 5.3.1 · 1 older release