Guzzle vulnerabilities
We track 8 vulnerabilities in Guzzle products across 2 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on August 3, 2026.
Latest Guzzle vulnerabilities
- 7.2 High severity
guzzle: Incorrect Behavior Order: Validate Before Canonicalize
Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPT_URL to the URI exactly as written and push that Host into CURLOPT_HTTPHE
- 7.5 High severity
psr7: Interpretation Conflict
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is us
- 7.7 High severity
guzzle: Exposure of Sensitive Information to an Unauthorized Actor
Guzzle, an extensible PHP HTTP client. `Authorization` and `Cookie` headers on requests are sensitive information. In affected versions on making a request which responds with a redirect to a URI with a different port, if we choose to follow it, we should remo
- 7.7 High severity
guzzle: Improper Removal of Sensitive Information Before Storage or Transfer
Guzzle, an extensible PHP HTTP client. `Authorization` headers on requests are sensitive information. In affected versions when using our Curl handler, it is possible to use the `CURLOPT_HTTPAUTH` option to specify an `Authorization` header. On making a reques
- 7.5 High severity
guzzle: Improper Removal of Sensitive Information Before Storage or Transfer
Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, we should not
- 7.5 High severity
guzzle: Improper Removal of Sensitive Information Before Storage or Transfer
Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, or on making a r
- 8.1 High severity
guzzle: Reliance on Cookies without Validation and Integrity Checking
Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cookie
- 7.5 High severity
guzzlehttp/psr7 is a PSR-7 HTTP message library.
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currentl