Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 5.3, published 1 August 2026.

Which products and versions are affected?

Guzzle < 7.14.2; guzzlehttp/guzzle (Packagist) < 7.14.2.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Guzzle or guzzlehttp/guzzle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Guzzle Proxy-Authorization header disclosure to origin servers

Q: Which products and versions are affected?

Guzzle < 7.14.2; guzzlehttp/guzzle (Packagist) < 7.14.2.

Q: Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run Guzzle or guzzlehttp/guzzle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 5.3 · Published 2026-08-01

Guzzle, a popular PHP library for making web requests, contains a flaw where sensitive proxy login credentials can be accidentally sent to the wrong destination. If an application is configured to use a proxy, these credentials may be leaked to the final website being visited or to an attacker who redirects the connection. This could allow an unauthorized party to capture proxy passwords and gain access to restricted network resources.

Technologies: Guzzle, guzzlehttp/guzzle (Packagist). Vendors: Guzzle, Packagist.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 5.3, published 1 August 2026.
Which products and versions are affected?: Guzzle < 7.14.2; guzzlehttp/guzzle (Packagist) < 7.14.2.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Guzzle or guzzlehttp/guzzle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Guzzle versions prior to 7.14.2 fail to properly isolate the Proxy-Authorization header when using cURL or stream handlers. The library's internal logic for migrating headers to the proxy-specific channel (CURLOPT_PROXYHEADER) relies on a prediction of the request route rather than the actual path taken by libcurl. Consequently, if a request is redirected from a proxied hop to a direct connection, or if SOCKS proxies are used, the sensitive header remains in the standard origin header list. An attacker controlling an origin server or a redirect destination can capture these credentials from server logs. The issue is resolved in version 7.14.2 by ensuring headers are stripped or correctly isolated regardless of the predicted route.

Affected products

guzzlehttp guzzle < 7.14.2

Timeline

2026-07-14: advisory: Original advisory GHSA-94pj-82f3-465w published
2026-08-01: disclosed: CVE-2026-67339 published
2026-08-04: other: Duplicate advisory GHSA-32rq-jhr7-m3hh withdrawn

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.