Medium severity · published Aug 1, 2026
CVE-2026-67339
guzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as direct connections.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GU
guzzle · guzzle
before 7.14.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-67339
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-67339
vendor-advisory
https://github.com/guzzle/guzzle/security/advisories/GHSA-94pj-82f3-465w
third-party-advisory
https://www.vulncheck.com/advisories/guzzlehttp-guzzle-before-proxy-authorization-header-disclosure
More from guzzle
7.2
CVE-2026-69246
Guzzle: Noncanonical host can bypass host-based checks
6.5
CVE-2026-69245
Guzzle: Noncanonical cookie domain keeps subdomain scope
6.1
CVE-2026-59883
Guzzle: Cookie Disclosure and Injection via IP-Address Domains
5.9
CVE-2026-67354
guzzlehttp/guzzle before 7.15.1 URI Fragment Disclosure via Referer
5.9
CVE-2026-67355
guzzlehttp/guzzle before 7.15.1 Host-only Cookie Scope