Executive brief
Guzzle, a popular PHP library for making web requests, contains a flaw where sensitive proxy login credentials can be accidentally sent to the wrong destination. If an application is configured to use a proxy, these credentials may be leaked to the final website being visited or to an attacker who redirects the connection. This could allow an unauthorized party to capture proxy passwords and gain access to restricted network resources.
Technical details
Guzzle versions prior to 7.14.2 fail to properly isolate the Proxy-Authorization header when using cURL or stream handlers. The library's internal logic for migrating headers to the proxy-specific channel (CURLOPT_PROXYHEADER) relies on a prediction of the request route rather than the actual path taken by libcurl. Consequently, if a request is redirected from a proxied hop to a direct connection, or if SOCKS proxies are used, the sensitive header remains in the standard origin header list. An attacker controlling an origin server or a redirect destination can capture these credentials from server logs. The issue is resolved in version 7.14.2 by ensuring headers are stripped or correctly isolated regardless of the predicted route.
Affected products
- guzzlehttp guzzle < 7.14.2
Timeline
- 2026-07-14: advisory: Original advisory GHSA-94pj-82f3-465w published
- 2026-08-01: disclosed: CVE-2026-67339 published
- 2026-08-04: other: Duplicate advisory GHSA-32rq-jhr7-m3hh withdrawn