{"schema_version":1,"title":"Guzzle vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 13 vulnerabilities in Guzzle: 0 in the last 7 days and 9 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-69246, was published on 3 August 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/guzzle","json_url":"https://junglewise.ai/threats/vendors/guzzle.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/guzzle","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":1,"all_time":13,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":9,"last_365_days":12},"latest":[{"cve":"CVE-2026-69246","cvss":7.2,"slug":"cve-2026-69246-guzzle-noncanonical-host-bypass-in-uri-handlers","title":"Guzzle noncanonical host bypass in URI handlers","severity":"high","exploited":false,"published_at":"2026-08-03T21:07:26+00:00","url":"https://junglewise.ai/threats/cve-2026-69246-guzzle-noncanonical-host-bypass-in-uri-handlers"},{"cvss":5.3,"slug":"guzzle-unbounded-response-cookies-denial-of-service-in-cookiejar-f650c2bc","title":"Guzzle unbounded response cookies denial of service in CookieJar","severity":"medium","exploited":false,"published_at":"2026-08-01T15:30:30+00:00","url":"https://junglewise.ai/threats/guzzle-unbounded-response-cookies-denial-of-service-in-cookiejar-f650c2bc"},{"cvss":5.9,"slug":"guzzle-information-disclosure-in-redirectmiddleware-referer-headers-d2e711b6","title":"Guzzle information disclosure in RedirectMiddleware Referer headers","severity":"medium","exploited":false,"published_at":"2026-08-01T15:30:30+00:00","url":"https://junglewise.ai/threats/guzzle-information-disclosure-in-redirectmiddleware-referer-headers-d2e711b6"},{"cvss":5.9,"slug":"guzzle-guzzlehttp-host-only-cookie-scope-disclosure-958db8d5","title":"Guzzle GuzzleHTTP host-only cookie scope disclosure","severity":"medium","exploited":false,"published_at":"2026-08-01T15:30:30+00:00","url":"https://junglewise.ai/threats/guzzle-guzzlehttp-host-only-cookie-scope-disclosure-958db8d5"},{"cvss":5.3,"slug":"guzzle-proxy-authorization-header-disclosure-to-origin-servers-7a8a6575","title":"Guzzle Proxy-Authorization header disclosure to origin servers","severity":"medium","exploited":false,"published_at":"2026-08-01T15:30:29+00:00","url":"https://junglewise.ai/threats/guzzle-proxy-authorization-header-disclosure-to-origin-servers-7a8a6575"},{"cve":"CVE-2026-67355","cvss":5.9,"epss":0.0037,"slug":"cve-2026-67355-guzzle-host-only-cookie-scope-not-preserved","title":"Guzzle host-only cookie scope not preserved","severity":"medium","exploited":false,"published_at":"2026-08-01T13:17:06.283+00:00","url":"https://junglewise.ai/threats/cve-2026-67355-guzzle-host-only-cookie-scope-not-preserved"},{"cve":"CVE-2026-67354","cvss":5.9,"epss":0.0037,"slug":"cve-2026-67354-guzzle-uri-fragment-disclosure-in-redirect-referer-header","title":"Guzzle URI fragment disclosure in redirect Referer header","severity":"medium","exploited":false,"published_at":"2026-08-01T13:17:06.143+00:00","url":"https://junglewise.ai/threats/cve-2026-67354-guzzle-uri-fragment-disclosure-in-redirect-referer-header"},{"cvss":5.3,"slug":"guzzle-cookiejar-unbounded-resource-allocation-denial-of-service-0cbc24e3","title":"Guzzle CookieJar unbounded resource allocation denial of service","severity":"medium","exploited":false,"published_at":"2026-07-20T23:27:02+00:00","url":"https://junglewise.ai/threats/guzzle-cookiejar-unbounded-resource-allocation-denial-of-service-0cbc24e3"},{"cve":"CVE-2026-59883","cvss":4.7,"epss":0.0012,"slug":"cve-2026-59883-guzzle-cookiejar-cross-host-cookie-disclosure-via-ip-domain","title":"Guzzle CookieJar cross-host cookie disclosure via IP domain matching","severity":"medium","exploited":false,"published_at":"2026-07-08T17:17:26.737+00:00","url":"https://junglewise.ai/threats/cve-2026-59883-guzzle-cookiejar-cross-host-cookie-disclosure-via-ip-domain"},{"cve":"CVE-2026-55767","cvss":5.8,"slug":"cve-2026-55767-guzzle-cookiejar-improper-domain-validation-allows-cookie","title":"Guzzle CookieJar improper domain validation allows cookie injection","severity":"medium","exploited":false,"published_at":"2026-06-23T16:17:03.263+00:00","url":"https://junglewise.ai/threats/cve-2026-55767-guzzle-cookiejar-improper-domain-validation-allows-cookie"},{"cve":"CVE-2026-55568","cvss":5.9,"slug":"cve-2026-55568-guzzle-silent-https-proxy-downgrade-to-cleartext","title":"Guzzle silent HTTPS proxy downgrade to cleartext","severity":"medium","exploited":false,"published_at":"2026-06-23T16:17:02.99+00:00","url":"https://junglewise.ai/threats/cve-2026-55568-guzzle-silent-https-proxy-downgrade-to-cleartext"},{"cve":"CVE-2026-53723","cvss":5.8,"slug":"cve-2026-53723-guzzle-guzzle-services-xml-injection-in-request-serializer","title":"Guzzle Guzzle Services XML injection in request serializer","severity":"medium","exploited":false,"published_at":"2026-06-11T14:16:31.403+00:00","url":"https://junglewise.ai/threats/cve-2026-53723-guzzle-guzzle-services-xml-injection-in-request-serializer"},{"cve":"CVE-2025-21617","cvss":6.3,"epss":0.0045,"slug":"cve-2025-21617-guzzle-oauth-subscriber-weak-prng-in-nonce-generation","title":"Guzzle OAuth Subscriber weak PRNG in nonce generation","severity":"medium","exploited":false,"published_at":"2025-01-06T19:23:26+00:00","url":"https://junglewise.ai/threats/cve-2025-21617-guzzle-oauth-subscriber-weak-prng-in-nonce-generation"}],"vendor":{"hub":true,"name":"Guzzle","slug":"guzzle","homepage":"https://github.com/guzzle","description":"Guzzle is a PHP HTTP client that provides an interface for sending HTTP requests and integrating with web services.","url":"https://junglewise.ai/threats/vendors/guzzle"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":6},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-69246","cvss":7.2,"slug":"cve-2026-69246-guzzle-noncanonical-host-bypass-in-uri-handlers","title":"Guzzle noncanonical host bypass in URI handlers","severity":"high","exploited":false,"published_at":"2026-08-03T21:07:26+00:00","url":"https://junglewise.ai/threats/cve-2026-69246-guzzle-noncanonical-host-bypass-in-uri-handlers"},{"cve":"CVE-2025-21617","cvss":6.3,"epss":0.0045,"slug":"cve-2025-21617-guzzle-oauth-subscriber-weak-prng-in-nonce-generation","title":"Guzzle OAuth Subscriber weak PRNG in nonce generation","severity":"medium","exploited":false,"published_at":"2025-01-06T19:23:26+00:00","url":"https://junglewise.ai/threats/cve-2025-21617-guzzle-oauth-subscriber-weak-prng-in-nonce-generation"},{"cve":"CVE-2026-67355","cvss":5.9,"epss":0.0037,"slug":"cve-2026-67355-guzzle-host-only-cookie-scope-not-preserved","title":"Guzzle host-only cookie scope not preserved","severity":"medium","exploited":false,"published_at":"2026-08-01T13:17:06.283+00:00","url":"https://junglewise.ai/threats/cve-2026-67355-guzzle-host-only-cookie-scope-not-preserved"},{"cve":"CVE-2026-67354","cvss":5.9,"epss":0.0037,"slug":"cve-2026-67354-guzzle-uri-fragment-disclosure-in-redirect-referer-header","title":"Guzzle URI fragment disclosure in redirect Referer header","severity":"medium","exploited":false,"published_at":"2026-08-01T13:17:06.143+00:00","url":"https://junglewise.ai/threats/cve-2026-67354-guzzle-uri-fragment-disclosure-in-redirect-referer-header"},{"cvss":5.9,"slug":"guzzle-information-disclosure-in-redirectmiddleware-referer-headers-d2e711b6","title":"Guzzle information disclosure in RedirectMiddleware Referer headers","severity":"medium","exploited":false,"published_at":"2026-08-01T15:30:30+00:00","url":"https://junglewise.ai/threats/guzzle-information-disclosure-in-redirectmiddleware-referer-headers-d2e711b6"},{"cvss":5.9,"slug":"guzzle-guzzlehttp-host-only-cookie-scope-disclosure-958db8d5","title":"Guzzle GuzzleHTTP host-only cookie scope disclosure","severity":"medium","exploited":false,"published_at":"2026-08-01T15:30:30+00:00","url":"https://junglewise.ai/threats/guzzle-guzzlehttp-host-only-cookie-scope-disclosure-958db8d5"},{"cve":"CVE-2026-55568","cvss":5.9,"slug":"cve-2026-55568-guzzle-silent-https-proxy-downgrade-to-cleartext","title":"Guzzle silent HTTPS proxy downgrade to cleartext","severity":"medium","exploited":false,"published_at":"2026-06-23T16:17:02.99+00:00","url":"https://junglewise.ai/threats/cve-2026-55568-guzzle-silent-https-proxy-downgrade-to-cleartext"},{"cve":"CVE-2026-55767","cvss":5.8,"slug":"cve-2026-55767-guzzle-cookiejar-improper-domain-validation-allows-cookie","title":"Guzzle CookieJar improper domain validation allows cookie injection","severity":"medium","exploited":false,"published_at":"2026-06-23T16:17:03.263+00:00","url":"https://junglewise.ai/threats/cve-2026-55767-guzzle-cookiejar-improper-domain-validation-allows-cookie"},{"cve":"CVE-2026-53723","cvss":5.8,"slug":"cve-2026-53723-guzzle-guzzle-services-xml-injection-in-request-serializer","title":"Guzzle Guzzle Services XML injection in request serializer","severity":"medium","exploited":false,"published_at":"2026-06-11T14:16:31.403+00:00","url":"https://junglewise.ai/threats/cve-2026-53723-guzzle-guzzle-services-xml-injection-in-request-serializer"},{"cvss":5.3,"slug":"guzzle-unbounded-response-cookies-denial-of-service-in-cookiejar-f650c2bc","title":"Guzzle unbounded response cookies denial of service in CookieJar","severity":"medium","exploited":false,"published_at":"2026-08-01T15:30:30+00:00","url":"https://junglewise.ai/threats/guzzle-unbounded-response-cookies-denial-of-service-in-cookiejar-f650c2bc"}],"generated_at":"2026-09-26T09:11:00.170868+00:00","technologies":[{"name":"Guzzle","slug":"guzzle","vulnerabilities":11,"url":"https://junglewise.ai/threats/technologies/guzzle"}]}