CVE-2026-55568: Guzzle PHP HTTP Client TLS Vulnerability

CVE-2026-55568 Overview

Guzzle is a widely used PHP HTTP client. CVE-2026-55568 describes a cleartext transmission flaw [CWE-311] affecting versions prior to 7.12.1. When applications configure an https:// proxy through Guzzle's built-in cURL handlers and run with libcurl older than 7.50.2, the proxy connection silently falls back to plaintext HTTP. Proxy authentication credentials, the Proxy-Authorization header, userinfo in the proxy URL, and CURLOPT_PROXYUSERPWD values are transmitted without encryption. The CONNECT target host and port for tunneled HTTPS requests are also exposed on the wire.

Critical Impact
Proxy credentials and CONNECT targets intended to be protected by TLS are leaked in cleartext over the network, exposing them to passive interception.

Affected Products

Guzzle PHP HTTP client versions prior to 7.12.1
Applications using GuzzleHttp\Handler\CurlHandler with an https:// proxy
Applications using GuzzleHttp\Handler\CurlMultiHandler with libcurl older than 7.50.2

Discovery Timeline

2026-06-23 - CVE-2026-55568 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-55568

Vulnerability Analysis

The flaw is a missing encryption of sensitive data weakness [CWE-311] in how Guzzle's default cURL handlers interact with older libcurl builds. Guzzle accepts an https:// proxy URL through its cURL handlers without verifying that the underlying libcurl supports HTTPS proxy connections. libcurl versions older than 7.50.2 silently downgrade an https:// proxy to plaintext http://. No error or warning is emitted, so the application has no signal that the proxy leg is unencrypted.

The consequence is confidentiality loss on the client-to-proxy hop. Any value an operator placed in the proxy URL or proxy authentication settings traverses the network in cleartext. For tunneled HTTPS requests, the CONNECT line reveals the target host and port even though the end-to-end TLS payload remains encrypted.

Root Cause

The root cause is reliance on libcurl to honor the https:// proxy scheme. Guzzle's CurlHandler and CurlMultiHandler pass the proxy URL to libcurl without checking the runtime libcurl version. Older libcurl builds do not implement HTTPS-to-proxy support and ignore the scheme. The handlers do not validate that the negotiated proxy transport matches the requested scheme.

Attack Vector

An attacker positioned on the network path between the application and the proxy can passively capture traffic. Captured data includes the Proxy-Authorization header value, basic auth userinfo embedded in the proxy URL, the value supplied via CURLOPT_PROXYUSERPWD, and the CONNECT target host and port for HTTPS requests. Exploitation requires no interaction with the application itself; the attacker only needs visibility into network segments traversed before the proxy.

No verified public exploit code is published. The vulnerability mechanism is documented in the GitHub Security Advisory GHSA-wpwq-4j6v-78m3.

Detection Methods for CVE-2026-55568

Indicators of Compromise

Outbound TCP connections from PHP application hosts to configured proxy endpoints on port 80 or other plaintext ports when an https:// proxy was configured.
Plaintext HTTP CONNECT requests on the wire containing Proxy-Authorization: Basic headers originating from PHP application servers.
libcurl runtime version reported by curl_version() lower than 7.50.2 on hosts running Guzzle.

Detection Strategies

Inventory all PHP applications and inspect Guzzle client configurations for proxy options using the https:// scheme.
Audit installed libcurl versions across PHP hosts and flag any system reporting a version earlier than 7.50.2.
Capture egress traffic from application subnets and search for CONNECT verbs or Proxy-Authorization headers on non-TLS ports.

Monitoring Recommendations

Forward web server, application, and network flow logs to a centralized analytics pipeline and alert on cleartext proxy authentication patterns.
Track Composer dependency manifests for guzzlehttp/guzzle versions below 7.12.1 and raise findings during CI builds.
Monitor for newly introduced CURLOPT_PROXYUSERPWD usage or proxy URLs containing userinfo in source code repositories.

How to Mitigate CVE-2026-55568

Immediate Actions Required

Upgrade guzzlehttp/guzzle to version 7.12.1 or later using composer update guzzlehttp/guzzle.
Upgrade libcurl on application hosts to version 7.50.2 or newer to ensure HTTPS-to-proxy support is honored.
Rotate any proxy credentials that were used with an https:// proxy configuration on vulnerable Guzzle and libcurl combinations.

Patch Information

The vulnerability is fixed in Guzzle 7.12.1. The maintainers documented the issue and remediation in the GitHub Security Advisory GHSA-wpwq-4j6v-78m3. Upgrading the library is the recommended path. Operators who cannot upgrade libcurl should validate that Guzzle 7.12.1 surfaces an error when the runtime cannot honor an https:// proxy.

Workarounds

Configure Guzzle to use an http:// proxy on a trusted local network segment rather than https:// until the upgrade is complete.
Remove credentials from proxy URLs and avoid CURLOPT_PROXYUSERPWD until both Guzzle and libcurl are updated.
Route proxy traffic through an encrypted tunnel such as a site-to-site VPN or SSH local forward to compensate for the cleartext hop.

bash

# Verify Guzzle and libcurl versions
composer show guzzlehttp/guzzle | grep versions
php -r 'echo curl_version()["version"] . PHP_EOL;'

# Upgrade Guzzle to the fixed release
composer require guzzlehttp/guzzle:^7.12.1