CVE-2026-67339 Overview
CVE-2026-67339 affects guzzlehttp/guzzle versions before 7.14.2, a widely used PHP HTTP client library. The library fails to properly isolate Proxy-Authorization headers from origin servers when using cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as direct connections. This information disclosure weakness is classified as [CWE-200].
Critical Impact
Proxy credentials transmitted through Guzzle can leak to origin servers, exposing authentication material used to access upstream proxy infrastructure.
Affected Products
- guzzlehttp/guzzle versions prior to 7.14.2
- PHP applications relying on Guzzle cURL handlers for outbound HTTP requests
- Applications routing traffic through authenticated HTTP or SOCKS proxies
Discovery Timeline
- 2026-08-01 - CVE-2026-67339 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-67339
Vulnerability Analysis
Guzzle constructs HTTP requests using cURL handlers and permits callers to attach a Proxy-Authorization header for upstream proxy authentication. The library does not strip this header when a request no longer terminates at the intended proxy. When cURL follows a redirect to an origin server, that origin receives the proxy credential in the request headers. The credential then persists in web server access logs, reverse proxy logs, and any downstream telemetry system that captures request headers.
The issue also affects SOCKS proxy handling. Guzzle misclassifies certain SOCKS proxy configurations as direct connections, causing the Proxy-Authorization header to travel end-to-end to the origin rather than being consumed by the proxy layer. Applications that rely on Guzzle to isolate proxy authentication material from third-party endpoints therefore expose those credentials to any operator of a targeted origin server.
Root Cause
The root cause is missing header scoping logic in the cURL handler. Guzzle treats Proxy-Authorization as a standard request header rather than as connection-scoped material that must be removed on redirect or when the effective transport differs from the configured proxy. This aligns with the information exposure pattern described in [CWE-200].
Attack Vector
Exploitation requires no authentication and no user interaction. An attacker who controls, compromises, or monitors an origin server that receives a redirected Guzzle request can read the Proxy-Authorization header from access logs. A malicious redirect target, a compromised third-party API endpoint, or a misconfigured SOCKS proxy configuration is sufficient to capture credentials. Recovered credentials can then be replayed against the upstream proxy to access internal networks or paid API tiers.
No verified public exploit code is available. See the GitHub Security Advisory for technical details.
Detection Methods for CVE-2026-67339
Indicators of Compromise
- Presence of Proxy-Authorization headers in origin server access logs, reverse proxy logs, or CDN telemetry
- Outbound requests from PHP application servers running guzzlehttp/guzzle versions below 7.14.2
- Unexpected redirects from trusted API endpoints to attacker-controlled hosts
Detection Strategies
- Inventory PHP dependencies and flag guzzlehttp/guzzle versions earlier than 7.14.2 using composer.lock audits.
- Grep web server and CDN logs for the string Proxy-Authorization to identify credential leakage that has already occurred.
- Correlate outbound proxy usage with 3xx redirect chains to detect requests where credentials could have traversed the redirect boundary.
Monitoring Recommendations
- Enable dependency scanning in CI to fail builds that pin vulnerable Guzzle releases.
- Alert on any log entry from application, proxy, or origin infrastructure that contains proxy credential headers.
- Monitor egress traffic for unexpected SOCKS proxy usage from application hosts that should not require SOCKS transport.
How to Mitigate CVE-2026-67339
Immediate Actions Required
- Upgrade guzzlehttp/guzzle to version 7.14.2 or later across all PHP applications.
- Rotate any proxy credentials that were configured with vulnerable Guzzle releases, especially where redirects or SOCKS transport were in use.
- Purge or restrict access to log stores that may contain leaked Proxy-Authorization headers.
Patch Information
The maintainers released a fix in guzzlehttp/guzzle7.14.2. Refer to the GitHub Security Advisory GHSA-94pj-82f3-465w and the VulnCheck Advisory for release notes and remediation guidance.
Workarounds
- Disable automatic redirect following in Guzzle by setting the allow_redirects option to false for requests that carry proxy credentials.
- Avoid attaching Proxy-Authorization headers directly; configure proxy authentication through the proxy request option so cURL scopes credentials to the proxy transport.
- Replace SOCKS proxy configurations with HTTP CONNECT proxies until the upgrade is completed on all affected hosts.
# Configuration example
composer require guzzlehttp/guzzle:^7.14.2
composer update guzzlehttp/guzzle
composer audit
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
