Executive brief
Guzzle, a popular tool used by PHP applications to communicate with other web services, contains a flaw that can expose sensitive data when using certain proxy configurations. If an application is configured to use a secure (HTTPS) proxy but is running on an older system, the connection may silently downgrade to an unencrypted format. This could allow an attacker to intercept proxy login credentials or see which websites the application is communicating with.
Technical details
A vulnerability exists in Guzzle's built-in cURL handlers (CurlHandler and CurlMultiHandler) where HTTPS proxy configurations are silently downgraded to plaintext. This occurs when Guzzle is used in conjunction with libcurl versions older than 7.50.2, which do not support HTTPS proxies and fail open by treating 'https://' as 'http://'. An attacker positioned on the network between the application and the proxy can capture sensitive information, including Proxy-Authorization headers, proxy userinfo, and the destination host/port of tunneled HTTPS requests. While the end-to-end TLS session of the final destination remains secure, the proxy authentication and metadata are compromised. The issue is fixed in Guzzle 7.12.1, which now explicitly validates libcurl capabilities before attempting an HTTPS proxy connection.
Affected products
- GuzzleHttp Guzzle < 7.12.1
Timeline
- 2026-06-18: advisory: GitHub Security Advisory GHSA-wpwq-4j6v-78m3 published
- 2026-06-23: disclosed: CVE-2026-55568 published to NVD
- 2026-06-23: patched: Fixed in version 7.12.1