Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

guzzlehttp/guzzle

15 known vulnerabilities (8 high, 6 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
15 · 8 high, 6 medium
Registry
Packagist

Advisories 15

  • Guzzle: Noncanonical host can bypass host-based checks

    Affected: fixed in 7.15.2; from 8.0.0, fixed in 8.0.1.

  • CVE-2026-69245Medium 6.5

    Guzzle: Noncanonical cookie domain keeps subdomain scope

    Affected: fixed in 7.15.2; from 8.0.0, fixed in 8.0.1.

  • guzzlehttp/guzzle before 7.15.1 URI Fragment Disclosure via Referer

    Affected: fixed in 7.15.1.

  • guzzlehttp/guzzle before 7.15.1 Host-only Cookie Scope

    Affected: fixed in 7.15.1.

  • CVE-2026-67353Medium 6.9

    guzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of Service

    Affected: fixed in 7.15.1.

  • CVE-2026-67339Medium 6.9

    guzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure

    Affected: fixed in 7.14.2.

  • CVE-2026-59883Medium 4.7

    Guzzle: Cookie Disclosure and Injection via IP-Address Domains

    Affected: fixed in 7.12.3.

  • CVE-2026-55767Medium 5.8

    Guzzle: Dot-Only Cookie Domains Match All Hosts in guzzlehttp/guzzle

    Affected: fixed in 7.12.1.

  • CVE-2026-55568Medium 5.9

    Guzzle: Silent HTTPS-Proxy Downgrade to Cleartext

    Affected: fixed in 7.12.1.

  • Change in port should be considered a change in origin in Guzzle

    Affected: fixed in 6.5.8; from 7.0.0, fixed in 7.4.5.

  • CURLOPT_HTTPAUTH option not cleared on change of origin in Guzzle

    Affected: fixed in 6.5.8; from 7.0.0, fixed in 7.4.5.

  • Fix failure to strip Authorization header on HTTP downgrade in Guzzle

    Affected: from 4.0.0, fixed in 6.5.7; from 7.0.0, fixed in 7.4.4.

  • Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle

    Affected: from 4.0.0, fixed in 6.5.7; from 7.0.0, fixed in 7.4.4.

  • Cross-domain cookie leakage in Guzzle

    Affected: fixed in 6.5.6; from 7.0.0, fixed in 7.4.3.

  • PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from…

    Affected: from 6, fixed in 6.2.1; from 4.0.0-rc2, fixed in 4.2.4; from 5, fixed in 5.3.1.