Executive brief
Guzzle, a popular PHP HTTP client, is vulnerable to a flaw where it incorrectly handles specially formatted web addresses (URIs). This allows an attacker to bypass security filters intended to block access to private internal servers or restricted websites. If exploited, an attacker could force the application to send requests to unintended destinations, potentially exposing sensitive internal data or bypassing access controls.
Technical details
A vulnerability exists in Guzzle's handling of request URIs and Host headers where the underlying transport (such as libcurl or PHP's stream handler) canonicalizes the host differently than Guzzle's validation logic. For example, a URI like 'http://127.0.0.%31/' may bypass application-level IP filters but be decoded by libcurl to '127.0.0.1', allowing access to the loopback interface. This interpretation conflict can also lead to incorrect proxy routing, improper cookie storage, and the unintended transmission of authentication credentials. The issue is rooted in Guzzle passing raw URI text to transports that perform their own percent-decoding and IDNA mapping. Patches in versions 7.15.2 and 8.0.1 introduce stricter validation of the request host and Host header before network I/O occurs.
Affected products
- Guzzle guzzle < 7.15.2, >= 8.0.0, < 8.0.1
Timeline
- 2026-07-26: disclosed
- 2026-08-03: advisory
- 2026-08-03: patched
References
- https://api.github.com/users/bilguunbicktivism
- https://github.com/bilguunbicktivism
- https://api.github.com/users/bilguunbicktivism/gists%7B/gist_id%7D
- https://api.github.com/users/bilguunbicktivism/repos
- https://avatars.githubusercontent.com/u/12601480?v=4
- https://api.github.com/users/bilguunbicktivism/events%7B/privacy%7D