# CVE-2026-69246: Guzzle noncanonical host bypass in URI handlers

Source: https://junglewise.ai/threats/cve-2026-69246-guzzle-noncanonical-host-bypass-in-uri-handlers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-03. Updated: 2026-08-03  
License: CC BY 4.0 with a link back

CVE-2026-69246 · Severity: high · CVSS 7.2 · Published 2026-08-03

Guzzle, a popular PHP HTTP client, is vulnerable to a flaw where it incorrectly handles specially formatted web addresses (URIs). This allows an attacker to bypass security filters intended to block access to private internal servers or restricted websites. If exploited, an attacker could force the application to send requests to unintended destinations, potentially exposing sensitive internal data or bypassing access controls.

Technologies: [Guzzle](https://junglewise.ai/threats/technologies/guzzle), [guzzlehttp/guzzle (Packagist)](https://junglewise.ai/threats/technologies/guzzlehttp-guzzle). Vendors: [Guzzle](https://junglewise.ai/threats/vendors/guzzle), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-69246 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69246 being exploited in the wild.

**How severe is CVE-2026-69246?** High severity, with a CVSS score of 7.2, published 3 August 2026.

**Which products and versions are affected?** Guzzle < 7.15.2, >= 8.0.0, < 8.0.1; guzzlehttp/guzzle (Packagist) ECOSYSTEM:introduced=0,fixed=7.15.2.

**Is there a fix for CVE-2026-69246?** Yes. guzzlehttp/guzzle (Packagist): upgrade to 7.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69246 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-69246?** Check whether you run Guzzle or guzzlehttp/guzzle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- guzzlehttp/guzzle (Packagist): upgrade to 7.15.2 or later

  ```sh
  composer require guzzlehttp/guzzle:^7.15.2
  ```


## Technical details

A vulnerability exists in Guzzle's handling of request URIs and Host headers where the underlying transport (such as libcurl or PHP's stream handler) canonicalizes the host differently than Guzzle's validation logic. For example, a URI like 'http://127.0.0.%31/' may bypass application-level IP filters but be decoded by libcurl to '127.0.0.1', allowing access to the loopback interface. This interpretation conflict can also lead to incorrect proxy routing, improper cookie storage, and the unintended transmission of authentication credentials. The issue is rooted in Guzzle passing raw URI text to transports that perform their own percent-decoding and IDNA mapping. Patches in versions 7.15.2 and 8.0.1 introduce stricter validation of the request host and Host header before network I/O occurs.

## Affected products

- Guzzle guzzle < 7.15.2, >= 8.0.0, < 8.0.1

## Identifiers

- CVE-2026-69246
- GHSA-v5mv-p594-2x33

## Timeline

- 2026-07-26: disclosed
- 2026-08-03: advisory
- 2026-08-03: patched

## References

- [https://api.github.com/users/bilguunbicktivism](https://api.github.com/users/bilguunbicktivism)
- [https://github.com/bilguunbicktivism](https://github.com/bilguunbicktivism)
- [https://api.github.com/users/bilguunbicktivism/gists%7B/gist_id%7D](https://api.github.com/users/bilguunbicktivism/gists%7B/gist_id%7D)
- [https://api.github.com/users/bilguunbicktivism/repos](https://api.github.com/users/bilguunbicktivism/repos)
- [https://avatars.githubusercontent.com/u/12601480?v=4](https://avatars.githubusercontent.com/u/12601480?v=4)
- [https://api.github.com/users/bilguunbicktivism/events%7B/privacy%7D](https://api.github.com/users/bilguunbicktivism/events%7B/privacy%7D)

## Related threats

- [Guzzle incorrect cookie domain matching for noncanonical IP addresses](https://junglewise.ai/threats/cve-2026-69245-guzzle-incorrect-cookie-domain-matching-for-noncanonical-ip)
- [Guzzle GuzzleHTTP host-only cookie scope disclosure](https://junglewise.ai/threats/guzzle-guzzlehttp-host-only-cookie-scope-disclosure-958db8d5)
- [Guzzle information disclosure in RedirectMiddleware Referer headers](https://junglewise.ai/threats/guzzle-information-disclosure-in-redirectmiddleware-referer-headers-d2e711b6)
- [Guzzle unbounded response cookies denial of service in CookieJar](https://junglewise.ai/threats/guzzle-unbounded-response-cookies-denial-of-service-in-cookiejar-f650c2bc)
- [Guzzle Proxy-Authorization header disclosure to origin servers](https://junglewise.ai/threats/guzzle-proxy-authorization-header-disclosure-to-origin-servers-7a8a6575)