PT-2026-67523 · Composer · Guzzle

CVE-2026-69246

·

Published

2026-08-03

·

Updated

2026-08-03

CVSS v3.1

7.2

High

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Guzzle versions prior to 7.15.2 Guzzle versions prior to 8.0.1
Description Guzzle provides the request URI as text to the transport and supplies the Host header separately. In the cURL handlers, CURLOPT URL is set to the URI as written and the Host is pushed into CURLOPT HTTPHEADER; the StreamHandler performs a similar action via fopen(). This creates a discrepancy because libcurl percent-decodes the authority and applies IDNA mapping before resolving the connection, while the supplied Host header suppresses the aligned one libcurl would normally generate. For example, a URI host like 127.0.0.%31 is rejected as an IP literal by filter var(), but libcurl decodes it to 127.0.0.1, allowing access to the loopback address without a DNS lookup while the server still receives Host: 127.0.0.%31.
An attacker who can influence a fetched URI may bypass application checks (such as denylists or private-range IP checks) to reach excluded hosts and read the responses. This divergence also affects Guzzle's internal logic: no proxy routing and RedirectMiddleware decisions regarding the stripping of Authorization and Cookie headers are based on the literal host rather than the actual contacted authority. Additionally, using a third-party UriInterface with a host like blocked.example.com@127.0.0.1 can result in the generation of an Authorization: Basic header from userinfo that the application did not intend to send.
Recommendations Update Guzzle to version 7.15.2 or later. Update Guzzle to version 8.0.1 or later. As a temporary workaround, manually constrain the host and any explicit Host header on every redirect hop by ensuring the host contains only printable ASCII characters (range 0x21 to 0x7E), contains no percent escapes (%), and does not end with a trailing dot.

Fix

SSRF

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2026-69246
GHSA-V5MV-P594-2X33

Affected Products

Guzzle