guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. (CVE-2026-67339)
guzzlehttp/guzzle versions before 7.14.2 contain a vulnerability where Proxy-Authorization headers are not properly isolated from origin servers when using cURL handlers. This can lead to proxy credentials being exposed in origin server access logs if requests are redirected, bypassed, or sent through SOCKS proxies misclassified as direct connections. The vulnerability has a CVSS score of 5.3 (medium severity).
AI Analysis
Technical Summary
The vulnerability in guzzlehttp/guzzle prior to version 7.14.2 involves improper isolation of Proxy-Authorization headers in cURL handlers. When requests are redirected or routed through SOCKS proxies that Guzzle incorrectly treats as direct connections, proxy credentials can be leaked to origin servers and recorded in their access logs. This exposure could allow attackers with access to those logs to obtain sensitive proxy authentication information. The issue is tracked as CVE-2026-67339 and is classified under CWE-200 (Information Exposure).
Potential Impact
The impact is limited to the confidentiality of proxy credentials, which may be exposed in origin server logs under certain request routing conditions. There is no indication of integrity or availability impact. The vulnerability requires no privileges and no user interaction to exploit, but the attacker must have access to origin server logs to benefit from the credential exposure.
Mitigation Recommendations
A fix is available in guzzlehttp/guzzle version 7.14.2. Users should upgrade to version 7.14.2 or later to resolve this vulnerability. Since this is not a cloud service, remediation depends on applying the official patch. Patch status is not explicitly confirmed in the input, but the version 7.14.2 is identified as the fixed version. No vendor advisory content contradicts this guidance.
guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. (CVE-2026-67339)
Description
guzzlehttp/guzzle versions before 7.14.2 contain a vulnerability where Proxy-Authorization headers are not properly isolated from origin servers when using cURL handlers. This can lead to proxy credentials being exposed in origin server access logs if requests are redirected, bypassed, or sent through SOCKS proxies misclassified as direct connections. The vulnerability has a CVSS score of 5.3 (medium severity).
CVSS v3.1
Score 5.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in guzzlehttp/guzzle prior to version 7.14.2 involves improper isolation of Proxy-Authorization headers in cURL handlers. When requests are redirected or routed through SOCKS proxies that Guzzle incorrectly treats as direct connections, proxy credentials can be leaked to origin servers and recorded in their access logs. This exposure could allow attackers with access to those logs to obtain sensitive proxy authentication information. The issue is tracked as CVE-2026-67339 and is classified under CWE-200 (Information Exposure).
Potential Impact
The impact is limited to the confidentiality of proxy credentials, which may be exposed in origin server logs under certain request routing conditions. There is no indication of integrity or availability impact. The vulnerability requires no privileges and no user interaction to exploit, but the attacker must have access to origin server logs to benefit from the credential exposure.
Mitigation Recommendations
A fix is available in guzzlehttp/guzzle version 7.14.2. Users should upgrade to version 7.14.2 or later to resolve this vulnerability. Since this is not a cloud service, remediation depends on applying the official patch. Patch status is not explicitly confirmed in the input, but the version 7.14.2 is identified as the fixed version. No vendor advisory content contradicts this guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-32rq-jhr7-m3hh
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-67339"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a6e6292bf32cb7a344f5f08
Added to database: 08/01/2026, 21:18:10 UTC
Last enriched: 08/01/2026, 21:20:33 UTC
Last updated: 08/02/2026, 00:26:21 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.