# guzzlehttp/guzzle (Packagist) vulnerabilities

15 known vulnerabilities (8 high, 6 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/guzzlehttp/guzzle

## Advisories (15)

### [CVE-2026-69246](https://cve.now/CVE-2026-69246): Guzzle: Noncanonical host can bypass host-based checks

- Severity: High 7.2
- Published: Aug 3, 2026
- Affected: fixed in 7.15.2; from 8.0.0, fixed in 8.0.1.

### [CVE-2026-69245](https://cve.now/CVE-2026-69245): Guzzle: Noncanonical cookie domain keeps subdomain scope

- Severity: Medium 6.5
- Published: Aug 3, 2026
- Affected: fixed in 7.15.2; from 8.0.0, fixed in 8.0.1.

### [CVE-2026-67354](https://cve.now/CVE-2026-67354): guzzlehttp/guzzle before 7.15.1 URI Fragment Disclosure via Referer

- Severity: High 8.2
- Published: Aug 1, 2026
- Affected: fixed in 7.15.1.

### [CVE-2026-67355](https://cve.now/CVE-2026-67355): guzzlehttp/guzzle before 7.15.1 Host-only Cookie Scope

- Severity: High 8.2
- Published: Aug 1, 2026
- Affected: fixed in 7.15.1.

### [CVE-2026-67353](https://cve.now/CVE-2026-67353): guzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of Service

- Severity: Medium 6.9
- Published: Aug 1, 2026
- Affected: fixed in 7.15.1.

### [CVE-2026-67339](https://cve.now/CVE-2026-67339): guzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure

- Severity: Medium 6.9
- Published: Aug 1, 2026
- Affected: fixed in 7.14.2.

### [CVE-2026-59883](https://cve.now/CVE-2026-59883): Guzzle: Cookie Disclosure and Injection via IP-Address Domains

- Severity: Medium 4.7
- Published: Jul 8, 2026
- Affected: fixed in 7.12.3.

### [CVE-2026-55767](https://cve.now/CVE-2026-55767): Guzzle: Dot-Only Cookie Domains Match All Hosts in guzzlehttp/guzzle

- Severity: Medium 5.8
- Published: Jun 23, 2026
- Affected: fixed in 7.12.1.

### [CVE-2026-55568](https://cve.now/CVE-2026-55568): Guzzle: Silent HTTPS-Proxy Downgrade to Cleartext

- Severity: Medium 5.9
- Published: Jun 23, 2026
- Affected: fixed in 7.12.1.

### [CVE-2022-31091](https://cve.now/CVE-2022-31091): Change in port should be considered a change in origin in Guzzle

- Severity: High 7.7
- Published: Jun 27, 2022
- Affected: fixed in 6.5.8; from 7.0.0, fixed in 7.4.5.

### [CVE-2022-31090](https://cve.now/CVE-2022-31090): CURLOPT\_HTTPAUTH option not cleared on change of origin in Guzzle

- Severity: High 7.7
- Published: Jun 27, 2022
- Affected: fixed in 6.5.8; from 7.0.0, fixed in 7.4.5.

### [CVE-2022-31043](https://cve.now/CVE-2022-31043): Fix failure to strip Authorization header on HTTP downgrade in Guzzle

- Severity: High 7.5
- Published: Jun 9, 2022
- Affected: from 4.0.0, fixed in 6.5.7; from 7.0.0, fixed in 7.4.4.

### [CVE-2022-31042](https://cve.now/CVE-2022-31042): Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle

- Severity: High 7.5
- Published: Jun 9, 2022
- Affected: from 4.0.0, fixed in 6.5.7; from 7.0.0, fixed in 7.4.4.

### [CVE-2022-29248](https://cve.now/CVE-2022-29248): Cross-domain cookie leakage in Guzzle

- Severity: High 8.0
- Published: May 25, 2022
- Affected: fixed in 6.5.6; from 7.0.0, fixed in 7.4.3.

### [CVE-2016-5385](https://cve.now/CVE-2016-5385): PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from…

- Severity: Unrated
- Published: Jul 19, 2016
- Affected: from 6, fixed in 6.2.1; from 4.0.0-rc2, fixed in 4.2.4; from 5, fixed in 5.3.1.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/guzzlehttp/guzzle
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.