Guzzle, a PHP HTTP client, prior to versions 7.15.2 and 8.0.1, passes the request URI as text to the transport and supplies the Host header separately. The cURL handlers set CURLOPT_URL to the literal URI and push the Host header into CURLOPT_HTTPHEADER. libcurl then parses and decodes the URI host, including percent-decoding and IDNA mapping, to resolve and connect to the target host. This can cause divergence between the host used by libcurl and the Host header sent to the server. For example, a URI host like 127.0.0.%31 is rejected by PHP's filter_var() as an IP literal but decoded by libcurl to 127.0.0.1, allowing connection to loopback while the Host header remains 127.0.0.%31. An attacker controlling the URI can exploit this to reach hosts excluded by application checks and read responses. This also affects proxy routing and redirect decisions based on the literal host. Exploitation requires the application to build request URIs from untrusted input and make host decisions before passing to Guzzle. The vulnerability is fixed in versions 7.15.2 and 8.0.1.

An attacker who can influence the URI used in a Guzzle request may bypass host-based access controls by exploiting the difference between the URI host as interpreted by libcurl and the Host header sent to the server. This can lead to unauthorized access to internal or excluded hosts and disclosure of response data. The vulnerability also affects proxy routing and authorization header stripping behavior, potentially impacting security decisions. There is no indication of denial of service or code execution impact.

Upgrade Guzzle to version 7.15.2 or later, or 8.0.1 or later, where this issue is fixed. If upgrading is not immediately possible, avoid building request URIs from untrusted input or performing host-based access control decisions before passing URIs to Guzzle. Patch status is confirmed fixed in the specified versions.