CVE-2026-67339 in Guzzle
Summary
by MITRE • 08/01/2026
guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as direct connections.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability in guzzlehttp/guzzle versions prior to 7.14.2 represents a critical security flaw in HTTP client implementation that stems from improper handling of proxy authentication headers within cURL transport mechanisms. This issue manifests when the library fails to properly isolate Proxy-Authorization headers from origin server communications, creating a dangerous exposure where sensitive authentication credentials can be inadvertently transmitted to unintended recipients. The flaw specifically impacts how Guzzle processes requests through various proxy configurations including redirects, bypass scenarios, and SOCKS proxy connections where the library incorrectly classifies these as direct connections rather than properly routing them through authenticated proxy mechanisms.
The technical nature of this vulnerability aligns with CWE-284 Access Control Issues and CWE-312 Cleartext Storage of Sensitive Information, as it enables unauthorized access to proxy authentication credentials that should remain isolated from origin server communications. When requests are processed through cURL handlers, the improper header isolation allows Proxy-Authorization information to be included in requests sent to origin servers, effectively exposing credentials that attackers can capture through various means including access log analysis, network traffic inspection, or compromised intermediate systems. This misclassification particularly affects scenarios involving HTTP redirects where the original proxy authentication headers may be forwarded to redirected endpoints, or when SOCKS proxy configurations are improperly handled by the library's connection routing logic.
The operational impact of this vulnerability extends beyond simple credential exposure to encompass potential compromise of entire network security postures and unauthorized access to protected resources. Organizations utilizing affected Guzzle versions may experience credential theft across multiple application layers and network boundaries since proxy authentication information becomes accessible to origin servers that should never receive such sensitive data. The vulnerability is particularly concerning in environments where applications communicate through corporate proxies with authenticated access controls, as it could enable attackers to escalate privileges or gain unauthorized access to internal systems that are protected by proxy-based authentication mechanisms. This exposure creates opportunities for lateral movement within networks and potential data exfiltration through compromised proxy credentials.
Mitigation strategies should focus on immediate version updates to Guzzle 7.14.2 or later, which include proper header isolation mechanisms that correctly separate proxy authentication information from origin server communications. Organizations must also implement comprehensive monitoring of access logs and network traffic to detect potential credential exposure, while considering additional security controls such as certificate pinning, enhanced network segmentation, and regular security audits of HTTP client implementations. The fix addresses the underlying cURL handler logic to ensure proper header management and connection routing, aligning with ATT&CK technique T1566 Credential Access through Proxy Authentication and T1071 Application Layer Protocol for maintaining persistent access through compromised proxy credentials. Security teams should also conduct thorough vulnerability assessments of all applications using Guzzle components to identify and remediate similar issues in their software supply chains, particularly focusing on the proper handling of authentication headers in HTTP client libraries that interact with proxy infrastructure.