Medium
guzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure
guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as direct connections.
Announced Source revision 1
Original source ↗CVE-2026-67339
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-67339
guzzle
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "guzzle",
"product": "guzzle",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "7.14.2",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.14.2",
"versionType": "semver"
}
],
"packageURL": "pkg:composer/guzzlehttp/guzzle",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-67339
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #12813 · Revision 1
- Added to Heist Feed
- Publisher date