Executive brief
Guzzle is a popular PHP HTTP client library used by applications to make web requests. A flaw in versions before 7.14.2 causes proxy authentication credentials (Proxy-Authorization headers) to be inadvertently sent to origin servers instead of being kept private for the proxy. An attacker controlling a web server that receives a redirected request could capture these credentials through access logs and potentially abuse the proxy to reach restricted resources or impersonate legitimate users.
Technical details
The vulnerability is a sensitive information disclosure (CWE-200) in the cURL handlers (CurlHandler and CurlMultiHandler) of Guzzle. The root cause is that Guzzle incorrectly places Proxy-Authorization headers in cURL's origin header list (CURLOPT_HTTPHEADER) instead of the proxy-only list (CURLOPT_PROXYHEADER) when certain routing conditions occur: direct connections, proxy-bypassed requests (via no_proxy rules), or SOCKS proxies misclassified as direct. The vulnerability also occurs when redirect middleware re-evaluates proxy routing but fails to strip Proxy-Authorization. An attacker can exploit this by controlling an origin server (via redirect or direct access) to capture proxy credentials in access logs. Attack vector is network-based with no authentication required. Patch available in version 7.14.2.
Affected products
- guzzlehttp Guzzle before 7.14.2
Timeline
- 2026-07-14: disclosed
- 2026-08-01: advisory: Published on NVD and VulnCheck
- 2026-07-14: patched: Fix released in version 7.14.2