{"schema_version":1,"title":"guzzlehttp/guzzle (Packagist) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 19 vulnerabilities in guzzlehttp/guzzle (Packagist): 0 in the last 7 days and 17 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, Guzzle GuzzleHTTP host-only cookie scope disclosure, was published on 1 August 2026.","url":"https://junglewise.ai/threats/technologies/guzzlehttp-guzzle","json_url":"https://junglewise.ai/threats/technologies/guzzlehttp-guzzle.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/guzzlehttp-guzzle","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":0,"all_time":19,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":17,"last_365_days":19},"latest":[{"cvss":5.9,"slug":"guzzle-guzzlehttp-host-only-cookie-scope-disclosure-958db8d5","title":"Guzzle GuzzleHTTP host-only cookie scope disclosure","severity":"medium","exploited":false,"published_at":"2026-08-01T15:30:30+00:00","url":"https://junglewise.ai/threats/guzzle-guzzlehttp-host-only-cookie-scope-disclosure-958db8d5"},{"cvss":5.3,"slug":"guzzle-unbounded-response-cookies-denial-of-service-in-cookiejar-f650c2bc","title":"Guzzle unbounded response cookies denial of service in CookieJar","severity":"medium","exploited":false,"published_at":"2026-08-01T15:30:30+00:00","url":"https://junglewise.ai/threats/guzzle-unbounded-response-cookies-denial-of-service-in-cookiejar-f650c2bc"},{"cvss":5.9,"slug":"guzzle-information-disclosure-in-redirectmiddleware-referer-headers-d2e711b6","title":"Guzzle information disclosure in RedirectMiddleware Referer headers","severity":"medium","exploited":false,"published_at":"2026-08-01T15:30:30+00:00","url":"https://junglewise.ai/threats/guzzle-information-disclosure-in-redirectmiddleware-referer-headers-d2e711b6"},{"cvss":3.1,"slug":"duplicate-advisory-guzzle-uri-fragments-disclosed-in-redirect-referer-0fd6463c","title":"Duplicate Advisory: Guzzle: URI fragments disclosed in redirect Referer headers","severity":"low","exploited":false,"published_at":"2026-08-01T15:30:30+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-guzzle-uri-fragments-disclosed-in-redirect-referer-0fd6463c"},{"cvss":3.1,"slug":"duplicate-advisory-guzzle-unbounded-response-cookies-risk-denial-of-11a34547","title":"Duplicate Advisory: Guzzle: Unbounded response cookies risk denial of service","severity":"low","exploited":false,"published_at":"2026-08-01T15:30:30+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-guzzle-unbounded-response-cookies-risk-denial-of-11a34547"},{"cvss":3.1,"slug":"duplicate-advisory-guzzle-host-only-cookie-scope-is-not-preserved-17469785","title":"Duplicate Advisory: Guzzle: Host-only cookie scope is not preserved","severity":"low","exploited":false,"published_at":"2026-08-01T15:30:30+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-guzzle-host-only-cookie-scope-is-not-preserved-17469785"},{"cvss":3.1,"slug":"duplicate-advisory-guzzle-proxy-authorization-headers-can-be-sent-to-0bcd4fcf","title":"Duplicate Advisory: Guzzle: Proxy-Authorization headers can be sent to origin servers","severity":"low","exploited":false,"published_at":"2026-08-01T15:30:29+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-guzzle-proxy-authorization-headers-can-be-sent-to-0bcd4fcf"},{"cvss":5.3,"slug":"guzzle-proxy-authorization-header-disclosure-to-origin-servers-7a8a6575","title":"Guzzle Proxy-Authorization header disclosure to origin servers","severity":"medium","exploited":false,"published_at":"2026-08-01T15:30:29+00:00","url":"https://junglewise.ai/threats/guzzle-proxy-authorization-header-disclosure-to-origin-servers-7a8a6575"},{"cve":"CVE-2026-67355","cvss":5.9,"epss":0.0037,"slug":"cve-2026-67355-guzzle-host-only-cookie-scope-not-preserved","title":"Guzzle host-only cookie scope not preserved","severity":"medium","exploited":false,"published_at":"2026-08-01T13:17:06.283+00:00","url":"https://junglewise.ai/threats/cve-2026-67355-guzzle-host-only-cookie-scope-not-preserved"},{"cve":"CVE-2026-67354","cvss":5.9,"epss":0.0037,"slug":"cve-2026-67354-guzzle-uri-fragment-disclosure-in-redirect-referer-header","title":"Guzzle URI fragment disclosure in redirect Referer header","severity":"medium","exploited":false,"published_at":"2026-08-01T13:17:06.143+00:00","url":"https://junglewise.ai/threats/cve-2026-67354-guzzle-uri-fragment-disclosure-in-redirect-referer-header"},{"cve":"CVE-2026-67353","cvss":5.3,"epss":0.0042,"slug":"cve-2026-67353-guzzlehttp-guzzle-denial-of-service-in-cookiejar","title":"guzzlehttp Guzzle denial of service in CookieJar","severity":"medium","exploited":false,"published_at":"2026-08-01T13:17:06+00:00","url":"https://junglewise.ai/threats/cve-2026-67353-guzzlehttp-guzzle-denial-of-service-in-cookiejar"},{"cve":"CVE-2026-67339","cvss":5.3,"epss":0.0037,"slug":"cve-2026-67339-guzzlehttp-guzzle-proxy-authorization-header-disclosure","title":"guzzlehttp Guzzle Proxy-Authorization header disclosure","severity":"medium","exploited":false,"published_at":"2026-08-01T13:17:04.99+00:00","url":"https://junglewise.ai/threats/cve-2026-67339-guzzlehttp-guzzle-proxy-authorization-header-disclosure"},{"cvss":5.9,"slug":"guzzle-uri-fragment-disclosure-in-redirect-referer-headers-716e485b","title":"Guzzle URI fragment disclosure in redirect Referer headers","severity":"medium","exploited":false,"published_at":"2026-07-20T23:28:36+00:00","url":"https://junglewise.ai/threats/guzzle-uri-fragment-disclosure-in-redirect-referer-headers-716e485b"},{"cvss":5.9,"slug":"guzzle-host-only-cookie-scope-disclosure-to-subdomains-b376d30d","title":"Guzzle host-only cookie scope disclosure to subdomains","severity":"medium","exploited":false,"published_at":"2026-07-20T23:27:49+00:00","url":"https://junglewise.ai/threats/guzzle-host-only-cookie-scope-disclosure-to-subdomains-b376d30d"},{"cvss":5.3,"slug":"guzzle-cookiejar-unbounded-resource-allocation-denial-of-service-0cbc24e3","title":"Guzzle CookieJar unbounded resource allocation denial of service","severity":"medium","exploited":false,"published_at":"2026-07-20T23:27:02+00:00","url":"https://junglewise.ai/threats/guzzle-cookiejar-unbounded-resource-allocation-denial-of-service-0cbc24e3"},{"cvss":5.3,"slug":"guzzle-proxy-authorization-credential-leakage-to-origin-servers-58a4be91","title":"Guzzle Proxy-Authorization credential leakage to origin servers","severity":"medium","exploited":false,"published_at":"2026-07-20T21:46:02+00:00","url":"https://junglewise.ai/threats/guzzle-proxy-authorization-credential-leakage-to-origin-servers-58a4be91"},{"cve":"CVE-2026-59883","cvss":4.7,"epss":0.0017,"slug":"cve-2026-59883-guzzle-cookiejar-cross-host-cookie-disclosure-via-ip-domain","title":"Guzzle CookieJar cross-host cookie disclosure via IP domain matching","severity":"medium","exploited":false,"published_at":"2026-07-08T17:17:26.737+00:00","url":"https://junglewise.ai/threats/cve-2026-59883-guzzle-cookiejar-cross-host-cookie-disclosure-via-ip-domain"},{"cve":"CVE-2026-55767","cvss":5.8,"epss":0.0021,"slug":"cve-2026-55767-guzzle-cookiejar-improper-domain-validation-allows-cookie","title":"Guzzle CookieJar improper domain validation allows cookie injection","severity":"medium","exploited":false,"published_at":"2026-06-23T16:17:03.263+00:00","url":"https://junglewise.ai/threats/cve-2026-55767-guzzle-cookiejar-improper-domain-validation-allows-cookie"},{"cve":"CVE-2026-55568","cvss":5.9,"epss":0.0015,"slug":"cve-2026-55568-guzzle-silent-https-proxy-downgrade-to-cleartext","title":"Guzzle silent HTTPS proxy downgrade to cleartext","severity":"medium","exploited":false,"published_at":"2026-06-23T16:17:02.99+00:00","url":"https://junglewise.ai/threats/cve-2026-55568-guzzle-silent-https-proxy-downgrade-to-cleartext"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":12},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"getgrav/grav (Packagist)","slug":"getgrav-grav","vulnerabilities":63,"url":"https://junglewise.ai/threats/technologies/getgrav-grav"},{"name":"wwbn/avideo (Packagist)","slug":"wwbn-avideo","vulnerabilities":58,"url":"https://junglewise.ai/threats/technologies/wwbn-avideo"},{"name":"concrete5/concrete5 (Packagist)","slug":"concrete5-concrete5","vulnerabilities":46,"url":"https://junglewise.ai/threats/technologies/concrete5-concrete5"},{"name":"snipe/snipe-it (Packagist)","slug":"snipe-snipe-it","vulnerabilities":39,"url":"https://junglewise.ai/threats/technologies/snipe-snipe-it"},{"name":"thorsten/phpmyfaq (Packagist)","slug":"thorsten-phpmyfaq","vulnerabilities":34,"url":"https://junglewise.ai/threats/technologies/thorsten-phpmyfaq"},{"name":"phpmyfaq/phpmyfaq (Packagist)","slug":"phpmyfaq-phpmyfaq","vulnerabilities":33,"url":"https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq"},{"name":"craftcms/cms (Packagist)","slug":"craftcms-cms","vulnerabilities":27,"url":"https://junglewise.ai/threats/technologies/craftcms-cms"},{"name":"mantisbt/mantisbt (Packagist)","slug":"mantisbt-mantisbt","vulnerabilities":26,"url":"https://junglewise.ai/threats/technologies/mantisbt-mantisbt"},{"name":"kimai/kimai (Packagist)","slug":"kimai-kimai","vulnerabilities":22,"url":"https://junglewise.ai/threats/technologies/kimai-kimai"},{"name":"froxlor/froxlor (Packagist)","slug":"froxlor-froxlor","vulnerabilities":18,"url":"https://junglewise.ai/threats/technologies/froxlor-froxlor"},{"name":"yeswiki/yeswiki (Packagist)","slug":"yeswiki-yeswiki","vulnerabilities":15,"url":"https://junglewise.ai/threats/technologies/yeswiki-yeswiki"},{"name":"twig/twig (Packagist)","slug":"twig-twig","vulnerabilities":14,"url":"https://junglewise.ai/threats/technologies/twig-twig"}],"technology":{"hub":true,"name":"guzzlehttp/guzzle (Packagist)","slug":"guzzlehttp-guzzle","vendor":{"name":"Packagist","slug":"packagist","url":"https://junglewise.ai/threats/vendors/packagist"},"aliases":[],"homepage":"https://docs.guzzlephp.org/","repo_url":"https://github.com/guzzle/guzzle","description":"Guzzle is a PHP HTTP client that provides an interface for sending HTTP requests and integrating with web services.","url":"https://junglewise.ai/threats/technologies/guzzlehttp-guzzle"},"most_severe":[{"cve":"CVE-2026-67355","cvss":5.9,"epss":0.0037,"slug":"cve-2026-67355-guzzle-host-only-cookie-scope-not-preserved","title":"Guzzle host-only cookie scope not preserved","severity":"medium","exploited":false,"published_at":"2026-08-01T13:17:06.283+00:00","url":"https://junglewise.ai/threats/cve-2026-67355-guzzle-host-only-cookie-scope-not-preserved"},{"cve":"CVE-2026-67354","cvss":5.9,"epss":0.0037,"slug":"cve-2026-67354-guzzle-uri-fragment-disclosure-in-redirect-referer-header","title":"Guzzle URI fragment disclosure in redirect Referer header","severity":"medium","exploited":false,"published_at":"2026-08-01T13:17:06.143+00:00","url":"https://junglewise.ai/threats/cve-2026-67354-guzzle-uri-fragment-disclosure-in-redirect-referer-header"},{"cve":"CVE-2026-55568","cvss":5.9,"epss":0.0015,"slug":"cve-2026-55568-guzzle-silent-https-proxy-downgrade-to-cleartext","title":"Guzzle silent HTTPS proxy downgrade to cleartext","severity":"medium","exploited":false,"published_at":"2026-06-23T16:17:02.99+00:00","url":"https://junglewise.ai/threats/cve-2026-55568-guzzle-silent-https-proxy-downgrade-to-cleartext"},{"cvss":5.9,"slug":"guzzle-information-disclosure-in-redirectmiddleware-referer-headers-d2e711b6","title":"Guzzle information disclosure in RedirectMiddleware Referer headers","severity":"medium","exploited":false,"published_at":"2026-08-01T15:30:30+00:00","url":"https://junglewise.ai/threats/guzzle-information-disclosure-in-redirectmiddleware-referer-headers-d2e711b6"},{"cvss":5.9,"slug":"guzzle-guzzlehttp-host-only-cookie-scope-disclosure-958db8d5","title":"Guzzle GuzzleHTTP host-only cookie scope disclosure","severity":"medium","exploited":false,"published_at":"2026-08-01T15:30:30+00:00","url":"https://junglewise.ai/threats/guzzle-guzzlehttp-host-only-cookie-scope-disclosure-958db8d5"},{"cvss":5.9,"slug":"guzzle-uri-fragment-disclosure-in-redirect-referer-headers-716e485b","title":"Guzzle URI fragment disclosure in redirect Referer headers","severity":"medium","exploited":false,"published_at":"2026-07-20T23:28:36+00:00","url":"https://junglewise.ai/threats/guzzle-uri-fragment-disclosure-in-redirect-referer-headers-716e485b"},{"cvss":5.9,"slug":"guzzle-host-only-cookie-scope-disclosure-to-subdomains-b376d30d","title":"Guzzle host-only cookie scope disclosure to subdomains","severity":"medium","exploited":false,"published_at":"2026-07-20T23:27:49+00:00","url":"https://junglewise.ai/threats/guzzle-host-only-cookie-scope-disclosure-to-subdomains-b376d30d"},{"cve":"CVE-2026-55767","cvss":5.8,"epss":0.0021,"slug":"cve-2026-55767-guzzle-cookiejar-improper-domain-validation-allows-cookie","title":"Guzzle CookieJar improper domain validation allows cookie injection","severity":"medium","exploited":false,"published_at":"2026-06-23T16:17:03.263+00:00","url":"https://junglewise.ai/threats/cve-2026-55767-guzzle-cookiejar-improper-domain-validation-allows-cookie"},{"cve":"CVE-2026-67353","cvss":5.3,"epss":0.0042,"slug":"cve-2026-67353-guzzlehttp-guzzle-denial-of-service-in-cookiejar","title":"guzzlehttp Guzzle denial of service in CookieJar","severity":"medium","exploited":false,"published_at":"2026-08-01T13:17:06+00:00","url":"https://junglewise.ai/threats/cve-2026-67353-guzzlehttp-guzzle-denial-of-service-in-cookiejar"},{"cve":"CVE-2026-67339","cvss":5.3,"epss":0.0037,"slug":"cve-2026-67339-guzzlehttp-guzzle-proxy-authorization-header-disclosure","title":"guzzlehttp Guzzle Proxy-Authorization header disclosure","severity":"medium","exploited":false,"published_at":"2026-08-01T13:17:04.99+00:00","url":"https://junglewise.ai/threats/cve-2026-67339-guzzlehttp-guzzle-proxy-authorization-header-disclosure"}],"generated_at":"2026-09-26T20:07:00.238639+00:00"}