GHSA-32rq-jhr7-m3hh

Summary

Duplicate Advisory: Guzzle: Proxy-Authorization headers can be sent to origin servers

Severity

medium

CVSS

5.3

CWE

CWE-200

Published

2026-08-01

Updated

2026-08-04

Advisory details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-94pj-82f3-465w. This link is maintained to preserve external references.

Original Description

guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as direct connections.

References

• https://github.com/advisories/GHSA-32rq-jhr7-m3hh
• https://github.com/guzzle/guzzle/security/advisories/GHSA-94pj-82f3-465w
• https://nvd.nist.gov/vuln/detail/CVE-2026-67339
• https://www.vulncheck.com/advisories/guzzlehttp-guzzle-before-proxy-authorization-header-disclosure

Related advisories

• CVE-2026-59883 — medium · Packagist/guzzlehttp/guzzle
• GHSA-94pj-82f3-465w — medium · Packagist/guzzlehttp/guzzle
• CVE-2026-69246 — high · Packagist/guzzlehttp/guzzle
• GHSA-mqq9-gxg5-m58g — high · Packagist/guzzlehttp/guzzle
• GHSA-mjrx-74jh-7xgw — high · Packagist/guzzlehttp/guzzle
• CVE-2026-69245 — medium · Packagist/guzzlehttp/guzzle
• GHSA-3fvr-2jw6-crq4 — medium · Packagist/guzzlehttp/guzzle
• GHSA-h95v-h523-3mw8 — medium · Packagist/guzzlehttp/guzzle

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity