Guzzle vulnerabilities

Products

• Guzzle 14
• Psr7 6

Newest

• guzzle Guzzle: Noncanonical host can bypass host-based checks CVE-2026-69246 Fix available 7.2 HighAugust 3, 2026
• guzzle Guzzle: Noncanonical cookie domain keeps subdomain scope CVE-2026-69245 Fix available 6.5 MediumAugust 3, 2026
• guzzle guzzlehttp/guzzle before 7.15.1 URI Fragment Disclosure via Referer CVE-2026-67354 Fix available 8.2 HighJuly 20, 2026
• guzzle guzzlehttp/guzzle before 7.15.1 Host-only Cookie Scope CVE-2026-67355 Fix available 8.2 HighJuly 20, 2026
• guzzle guzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of Service CVE-2026-67353 Fix available 6.9 MediumJuly 20, 2026
• guzzle guzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure CVE-2026-67339 Fix available 6.9 MediumJuly 20, 2026
• guzzle Guzzle: Cookie Disclosure and Injection via IP-Address Domains CVE-2026-59883 Fix available 4.7 MediumJuly 8, 2026
• guzzle psr7, guzzlephp psr-7 +1 more guzzlehttp/psr7: Host Confusion via Weak URI Host Validation CVE-2026-59882 Fix available 4.2 MediumJuly 8, 2026
• guzzle Guzzle: Dot-Only Cookie Domains Match All Hosts in guzzlehttp/guzzle CVE-2026-55767 Fix available 5.8 MediumJune 19, 2026
• guzzle psr7, guzzlephp psr-7 +1 more guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization CVE-2026-55766 Fix available 4.8 MediumJune 19, 2026
• guzzle Guzzle: Silent HTTPS-Proxy Downgrade to Cleartext CVE-2026-55568 Fix available 5.9 MediumJune 19, 2026
• guzzle guzzle-services guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator CVE-2026-53723 Fix available 5.8 MediumJune 11, 2026
• guzzle psr7, guzzlephp psr-7 +1 more guzzlehttp/psr7 has CRLF Injection via URI Host Component CVE-2026-49214 Fix available 5.3 MediumJune 11, 2026
• guzzle psr7, guzzlephp psr-7 +1 more guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation CVE-2026-48998 Fix available 5.3 MediumJune 11, 2026
• guzzle oauth-subscriber Guzzle OAuth Subscriber has insufficient nonce entropy CVE-2025-21617 Fix available 6.3 MediumJanuary 6, 2025
• guzzle psr7, guzzlephp psr-7, fedoraproject fedora +2 more Improper header name validation in guzzlehttp/psr7 CVE-2023-29197 Fix available 5.3 MediumApril 17, 2023
• guzzle, debian linux +1 more Change in port should be considered a change in origin in Guzzle CVE-2022-31091 Fix available 7.7 HighJune 21, 2022
• guzzle, debian linux +1 more CURLOPT_HTTPAUTH option not cleared on change of origin in Guzzle CVE-2022-31090 Fix available 7.7 HighJune 21, 2022
• guzzle, debian linux, drupal +2 more Fix failure to strip Authorization header on HTTP downgrade in Guzzle CVE-2022-31043 Fix available 7.5 HighJune 9, 2022
• guzzle, debian linux, drupal +2 more Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle CVE-2022-31042 Fix available 7.5 HighJune 9, 2022
• guzzle, debian linux, drupal +2 more Cross-domain cookie leakage in Guzzle CVE-2022-29248 Fix available 8.0 HighMay 25, 2022
• guzzle psr7, guzzlephp psr-7, drupal +2 more Improper Input Validation in guzzlehttp/psr7 CVE-2022-24775 Fix available 7.5 HighMarch 21, 2022