Guzzlephp - vulnerabilities (CVEs)
19 CVEs in 2 products, 0 in the last 30 days, newest from 2026-08-01.
Products
Newest CVEs of Guzzlephp
- CVE-2026-67354 - CVSS 8.2 (high), 2026-08-01: guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allow_redirects.referer…
- CVE-2026-67353 - CVSS 6.9 (medium), 2026-08-01: guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no…
- CVE-2026-67339 - CVSS 6.9 (medium), 2026-08-01: guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture…
- CVE-2026-67355 - CVSS 8.2 (high), 2026-08-01: guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as…
- CVE-2026-59883 - CVSS 6.1 (medium), 2026-07-08: Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain values to the exact…
- CVE-2026-59882 - CVSS 6.5 (medium), 2026-07-08: guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing…
- CVE-2026-55766 - CVSS 4.8 (medium), 2026-06-23: guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7 did not reject CR/LF characters in certain first-party…
- CVE-2026-55767 - CVSS 5.8 (medium), 2026-06-23: Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar incorrectly accepts cookies with a dot-only Domain attribute and whitespace-padded…
- CVE-2026-55568 - CVSS 5.9 (medium), 2026-06-23: Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in certain configurations, traffic expected to be protected by TLS on the hop to the proxy is…
- CVE-2026-48998 - CVSS 5.3 (medium), 2026-06-11: guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improper Host header validation when parsing raw HTTP…
- CVE-2026-49214 - CVSS 5.3 (medium), 2026-06-11: guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 did not reject ASCII control characters, whitespace, or DEL in…
- CVE-2023-29530 - CVSS 7.5 (high), 2023-04-24: Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users…
- CVE-2023-29197 - CVSS 7.5 (high), 2023-04-17: guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a…
- CVE-2022-31091 - CVSS 7.7 (high), 2022-06-27: Guzzle, an extensible PHP HTTP client. `Authorization` and `Cookie` headers on requests are sensitive information. In affected versions on making a request…
- CVE-2022-31090 - CVSS 7.7 (high), 2022-06-27: Guzzle, an extensible PHP HTTP client. `Authorization` headers on requests are sensitive information. In affected versions when using our Curl handler, it is…
- CVE-2022-31043 - CVSS 7.5 (high), 2022-06-10: Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the…
- CVE-2022-31042 - CVSS 7.5 (high), 2022-06-10: Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the…
- CVE-2022-29248 - CVSS 8.1 (high), 2022-05-25: Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not…
- CVE-2022-24775 - CVSS 7.5 (high), 2022-03-21: guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new…
