PT-2026-67523 · Composer · Guzzle
CVE-2026-69246
·
Published
2026-08-03
·
Updated
2026-08-03
CVSS v3.1
7.2
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Guzzle versions prior to 7.15.2
Guzzle versions prior to 8.0.1
Description
Guzzle provides the request URI as text to the transport and supplies the
Host header separately. In the cURL handlers, CURLOPT URL is set to the URI as written and the Host is pushed into CURLOPT HTTPHEADER; the StreamHandler performs a similar action via fopen(). This creates a discrepancy because libcurl percent-decodes the authority and applies IDNA mapping before resolving the connection, while the supplied Host header suppresses the aligned one libcurl would normally generate. For example, a URI host like 127.0.0.%31 is rejected as an IP literal by filter var(), but libcurl decodes it to 127.0.0.1, allowing access to the loopback address without a DNS lookup while the server still receives Host: 127.0.0.%31.An attacker who can influence a fetched URI may bypass application checks (such as denylists or private-range IP checks) to reach excluded hosts and read the responses. This divergence also affects Guzzle's internal logic:
no proxy routing and RedirectMiddleware decisions regarding the stripping of Authorization and Cookie headers are based on the literal host rather than the actual contacted authority. Additionally, using a third-party UriInterface with a host like blocked.example.com@127.0.0.1 can result in the generation of an Authorization: Basic header from userinfo that the application did not intend to send.Recommendations
Update Guzzle to version 7.15.2 or later.
Update Guzzle to version 8.0.1 or later.
As a temporary workaround, manually constrain the host and any explicit
Host header on every redirect hop by ensuring the host contains only printable ASCII characters (range 0x21 to 0x7E), contains no percent escapes (%), and does not end with a trailing dot.Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Guzzle