PT-2026-67319 · Composer · Guzzle
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
guzzlehttp/guzzle versions prior to 7.14.2
Description
The built-in cURL handlers (
CurlHandler and CurlMultiHandler) fail to properly isolate Proxy-Authorization headers from origin servers. This occurs because the handlers place first-class request headers into the origin header list (CURLOPT HTTPHEADER) and only move them to the proxy-only list (CURLOPT PROXYHEADER) when an HTTP or HTTPS proxy is predicted. Consequently, proxy credentials may be sent to the origin server if the request is direct, bypassed via no proxy settings, sent through a SOCKS proxy, or redirected from a proxied hop to a non-proxied route.On systems with libcurl older than 7.37.0 or PHP cURL extensions lacking
CURLOPT PROXYHEADER, CURLOPT HEADEROPT, and CURLHEADER SEPARATE, no proxy-only channel is available, leaving the header in the origin list for all routes. Additionally, the stream handler may expose credentials when combined with raw stream context.http.proxy overrides.An attacker controlling the origin server can capture these private credentials through access logs or tracing systems. This could allow the attacker to abuse access-controlled proxies or impersonate the proxy principal.
Recommendations
Update guzzlehttp/guzzle to version 7.14.2.
As a temporary workaround, remove first-class
Proxy-Authorization fields from requests, client defaults, and middleware, and instead provide proxy credentials via proxy URL userinfo (e.g., http://user:pass@proxy.example:8080) or use CURLOPT PROXYUSERPWD with cURL handlers.
Avoid combining proxy URL userinfo with first-class fields or raw stream context.http.proxy overrides.Exploit
Fix
Information Disclosure
Insufficiently Protected Credentials
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Guzzle