# CVE-2026-55568: Guzzle silent HTTPS proxy downgrade to cleartext

Source: https://junglewise.ai/threats/cve-2026-55568-guzzle-silent-https-proxy-downgrade-to-cleartext  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-55568 · Severity: medium · CVSS 5.9 · Published 2026-06-23

Guzzle, a popular tool used by PHP applications to communicate with other web services, contains a flaw that can expose sensitive data when using certain proxy configurations. If an application is configured to use a secure (HTTPS) proxy but is running on an older system, the connection may silently downgrade to an unencrypted format. This could allow an attacker to intercept proxy login credentials or see which websites the application is communicating with.

Technologies: [Guzzle](https://junglewise.ai/threats/technologies/guzzle), [guzzlehttp/guzzle (Packagist)](https://junglewise.ai/threats/technologies/guzzlehttp-guzzle). Vendors: [Guzzle](https://junglewise.ai/threats/vendors/guzzle), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-55568 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55568 being exploited in the wild.

**How severe is CVE-2026-55568?** Medium severity, with a CVSS score of 5.9, published 23 June 2026.

**Which products and versions are affected?** Guzzle < 7.12.1; guzzlehttp/guzzle (Packagist) < 7.12.1, ECOSYSTEM:introduced=0,fixed=7.12.1.

**Is there a fix for CVE-2026-55568?** Yes. guzzlehttp/guzzle (Packagist): upgrade to 7.12.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55568 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55568?** Check whether you run Guzzle or guzzlehttp/guzzle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- guzzlehttp/guzzle (Packagist): upgrade to 7.12.1 or later

  ```sh
  composer require guzzlehttp/guzzle:^7.12.1
  ```


## Technical details

A vulnerability exists in Guzzle's built-in cURL handlers (CurlHandler and CurlMultiHandler) where HTTPS proxy configurations are silently downgraded to plaintext. This occurs when Guzzle is used in conjunction with libcurl versions older than 7.50.2, which do not support HTTPS proxies and fail open by treating 'https://' as 'http://'. An attacker positioned on the network between the application and the proxy can capture sensitive information, including Proxy-Authorization headers, proxy userinfo, and the destination host/port of tunneled HTTPS requests. While the end-to-end TLS session of the final destination remains secure, the proxy authentication and metadata are compromised. The issue is fixed in Guzzle 7.12.1, which now explicitly validates libcurl capabilities before attempting an HTTPS proxy connection.

## Affected products

- GuzzleHttp Guzzle < 7.12.1

## Identifiers

- CVE-2026-55568
- GHSA-wpwq-4j6v-78m3

## Timeline

- 2026-06-18: advisory: GitHub Security Advisory GHSA-wpwq-4j6v-78m3 published
- 2026-06-23: disclosed: CVE-2026-55568 published to NVD
- 2026-06-23: patched: Fixed in version 7.12.1

## References

- [https://github.com/guzzle/guzzle/security/advisories/GHSA-wpwq-4j6v-78m3](https://github.com/guzzle/guzzle/security/advisories/GHSA-wpwq-4j6v-78m3)

## Related threats

- [Guzzle noncanonical host bypass in URI handlers](https://junglewise.ai/threats/cve-2026-69246-guzzle-noncanonical-host-bypass-in-uri-handlers)
- [Guzzle incorrect cookie domain matching for noncanonical IP addresses](https://junglewise.ai/threats/cve-2026-69245-guzzle-incorrect-cookie-domain-matching-for-noncanonical-ip)
- [Guzzle GuzzleHTTP host-only cookie scope disclosure](https://junglewise.ai/threats/guzzle-guzzlehttp-host-only-cookie-scope-disclosure-958db8d5)
- [Guzzle information disclosure in RedirectMiddleware Referer headers](https://junglewise.ai/threats/guzzle-information-disclosure-in-redirectmiddleware-referer-headers-d2e711b6)
- [Guzzle unbounded response cookies denial of service in CookieJar](https://junglewise.ai/threats/guzzle-unbounded-response-cookies-denial-of-service-in-cookiejar-f650c2bc)