Guzzle: Prior to 7.12.1, in certain configurations, traffic expected to be protected by TLS on the hop to the proxy is transmitted in cleartext. (CVE-2026-55568)

Guzzle is a PHP HTTP client that, before version 7.12.1, has a vulnerability when used with libcurl versions older than 7.50.2. In such configurations, the built-in cURL handlers accept an https:// proxy but libcurl silently treats it as a plaintext http:// proxy, never establishing a TLS connection to the proxy. This causes traffic, including proxy authentication credentials (Proxy-Authorization header, proxy userinfo, or CURLOPT_PROXYUSERPWD) and the CONNECT target host and port for HTTPS requests, to be transmitted unencrypted. The vulnerability affects applications that send requests through the built-in cURL handlers, configure an https:// proxy expecting encryption, and run with libcurl < 7.50.2. The issue is resolved in Guzzle version 7.12.1.

The vulnerability allows sensitive proxy authentication credentials and target connection details to be exposed in cleartext on the network segment between the client and the proxy. This compromises confidentiality of proxy credentials and potentially reveals target hosts and ports for HTTPS requests. There is no impact on data integrity or availability. The CVSS v3.1 score is 5.9 (medium severity), reflecting network attack vector, high complexity, no privileges required, no user interaction, and impact to confidentiality only.

Upgrade Guzzle to version 7.12.1 or later, which fixes this vulnerability. Additionally, ensure that libcurl is version 7.50.2 or newer to properly establish TLS connections to HTTPS proxies. If upgrading is not immediately possible, avoid configuring HTTPS proxies with the built-in cURL handlers or use alternative HTTP handlers that do not exhibit this behavior. Patch status is confirmed fixed in Guzzle 7.12.1.