Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-67339— guzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure

Quick assessment

Affected
guzzle guzzle
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

guzzle guzzle是guzzle组织的一款用于简化HTTP请求的PHP开发工具。 Guzzle 7.14.2之前版本存在信息泄露漏洞，该漏洞源于cURL处理程序未能正确隔离Proxy-Authorization标头与源服务器，可能导致攻击者在请求被重定向、绕过或通过Guzzle误分类为直接连接的SOCKS代理发送时，通过源服务器访问日志捕获代理凭据。

CVSS 5.3 · Medium EPSS 0.37% · P29

Affected Version Matrix 2

VendorProduct Version RangeStatus
guzzle guzzle < 7.14.2 affected
7.14.2 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-67339

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
guzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as direct connections.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Guzzle 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
guzzle guzzle是guzzle组织的一款用于简化HTTP请求的PHP开发工具。 Guzzle 7.14.2之前版本存在信息泄露漏洞，该漏洞源于cURL处理程序未能正确隔离Proxy-Authorization标头与源服务器，可能导致攻击者在请求被重定向、绕过或通过Guzzle误分类为直接连接的SOCKS代理发送时，通过源服务器访问日志捕获代理凭据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
guzzle guzzle 0 ~ 7.14.2 -

II. Public POCs for CVE-2026-67339

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-67339

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-67339 (2)

Same Patch Batch · guzzle · 2026-08-01 · 4 CVEs total

CVE-2026-67354 5.9 MEDIUM guzzlehttp/guzzle before 7.15.1 URI Fragment Disclosure via Referer
CVE-2026-67355 5.9 MEDIUM guzzlehttp/guzzle before 7.15.1 Host-only Cookie Scope
CVE-2026-67353 5.3 MEDIUM guzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of Service

IV. Related Vulnerabilities

Same product: guzzle
Same vendor: guzzle
Same weakness: CWE-200

V. Comments for CVE-2026-67339

No comments yet

Leave a comment