Vulnerability advisory

CVE-2026-67339

guzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure

Published Aug 1, 2026Updated Oct 28, 2026OSV record ↗

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/guzzle/guzzle ↗
All commits before fa88c57803501ad0770f5cddb1e60525d49da9a1	`fa88c57803501ad0770f5cddb1e60525d49da9a1`
Also listed as affected (144) `7.14.1` `7.14.0` `7.13.1` `7.13.0` `7.11.0` `7.10.0` `7.9.3` `7.9.2` `7.9.1` `7.9.0` `7.8.1` `7.8.0` `7.7.0` `7.6.1` `7.6.0` `7.5.1` `7.5.0` `7.4.5` `7.4.4` `7.4.3` `7.4.2` `7.4.1` `7.4.0` `7.3.0` `7.2.0` `7.1.1` `7.1.0` `7.0.0` `7.0.0-rc.1` `7.0.0-beta.2` `7.0.0-beta.1` `6.5.0` `6.4.1` `6.4.0` `6.3.3` `6.3.2` `6.3.1` `6.3.0` `6.2.2` `6.2.1` `4.2.3` `6.2.0` `6.1.1` `6.1.0` `6.0.2` `6.0.1` `6.0.0` `5.3.0` `5.2.0` `5.1.0` `5.0.3` `5.0.2` `5.0.1` `5.0.0` `4.2.2` `4.2.1` `4.2.0` `4.1.8` `4.1.7` `4.1.6` `4.1.5` `4.1.4` `4.1.3` `4.1.2` `4.1.1` `4.1.0` `4.0.2` `4.0.1` `4.0.0` `4.0.0-rc.2` `4.0.0-rc.1` `v3.8.1` `v3.8.0` `v3.7.4` `v3.7.3` `v3.7.2` `v3.7.1` `v3.7.0` `v3.6.0` `v3.5.0` `v3.4.3` `v3.4.2` `v3.4.1` `v3.4.0` `v3.3.1` `v3.3.0` `v3.2.0` `v3.1.2` `v3.1.1` `v3.1.0` `v3.0.7` `v3.0.6` `v3.0.5` `v3.0.4` `v3.0.3` `v3.0.2` `v3.0.1` `v3.0.0` `v2.8.8` `v2.8.7` `v2.8.6` `v2.8.5` `v2.8.4` `v2.8.3` `v2.8.2` `v2.8.1` `v2.8.0` `v2.7.2` `v2.7.1` `v2.7.0` `v2.6.6` `v2.6.5` `v2.6.4` `v2.6.3` `v2.6.2` `v2.6.1` `v2.6.0` `v2.5.0` `v2.4.1` `v2.4.0` `v2.3.2` `v2.3.1` `v2.3.0` `v2.2.4` `v2.2.3` `v2.2.2` `v2.2.1` `v2.2.0` `v2.1.4` `v2.1.3` `v2.1.2` `v2.1.1` `v2.1.0` `v2.0.5` `v2.0.4` `v2.0.3` `v2.0.2` `v2.0.1` `v2.0.0` `v1.0.3` `v1.0.2` `v1.0.1` `v1.0.0` `v1.0.0beta1`

Description

guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as direct connections.

CVE-2026-67339

Affected versions

Repository

Description

References