CVE-2026-55568: Guzzle silent HTTPS proxy downgrade to cleartext

CVE-2026-55568 · Severity: medium · CVSS 5.9 · Published 2026-06-23

Guzzle, a popular tool used by PHP applications to communicate with other web services, contains a flaw that can expose sensitive data when using certain proxy configurations. If an application is configured to use a secure (HTTPS) proxy but is running on an older system, the connection may silently downgrade to an unencrypted format. This could allow an attacker to intercept proxy login credentials or see which websites the application is communicating with.

Technologies: Guzzle, guzzlehttp/guzzle (Packagist). Vendors: Guzzle, Packagist.

Quick answers

Is CVE-2026-55568 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55568 being exploited in the wild.
How severe is CVE-2026-55568?
Medium severity, with a CVSS score of 5.9, published 23 June 2026.
Which products and versions are affected?
Guzzle < 7.12.1; guzzlehttp/guzzle (Packagist) < 7.12.1, ECOSYSTEM:introduced=0,fixed=7.12.1.
Is there a fix for CVE-2026-55568?
Yes. guzzlehttp/guzzle (Packagist): upgrade to 7.12.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55568 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55568?
Check whether you run Guzzle or guzzlehttp/guzzle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • guzzlehttp/guzzle (Packagist): upgrade to 7.12.1 or later
    composer require guzzlehttp/guzzle:^7.12.1

Technical details

A vulnerability exists in Guzzle's built-in cURL handlers (CurlHandler and CurlMultiHandler) where HTTPS proxy configurations are silently downgraded to plaintext. This occurs when Guzzle is used in conjunction with libcurl versions older than 7.50.2, which do not support HTTPS proxies and fail open by treating 'https://' as 'http://'. An attacker positioned on the network between the application and the proxy can capture sensitive information, including Proxy-Authorization headers, proxy userinfo, and the destination host/port of tunneled HTTPS requests. While the end-to-end TLS session of the final destination remains secure, the proxy authentication and metadata are compromised. The issue is fixed in Guzzle 7.12.1, which now explicitly validates libcurl capabilities before attempting an HTTPS proxy connection.

Affected products

  • GuzzleHttp Guzzle < 7.12.1

Identifiers

  • CVE-2026-55568
  • GHSA-wpwq-4j6v-78m3

Timeline

  • 2026-06-18: advisory: GitHub Security Advisory GHSA-wpwq-4j6v-78m3 published
  • 2026-06-23: disclosed: CVE-2026-55568 published to NVD
  • 2026-06-23: patched: Fixed in version 7.12.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.