Threat Intelligence Database

guzzlehttp/guzzle versions before 7.14.2 contain a vulnerability where Proxy-Authorization headers are not properly isolated from origin servers when using cURL handlers. This can lead to proxy credentials being exposed in origin server access logs if requests are redirected, bypassed, or sent through SOCKS proxies misclassified as direct connections. The vulnerability has a CVSS score of 5.3 (medium severity).

guzzlehttp/guzzle versions before 7.15.1 have a denial of service vulnerability in the CookieJar component. This vulnerability arises because the CookieJar accepts unlimited Set-Cookie header fields without size restrictions. An attacker can exploit this by returning many large cookies from a malicious server, causing excessive memory consumption and oversized Cookie headers that may fail in request handlers or destination servers. The vulnerability has a CVSS score of 5.3, indicating medium severity.

guzzlehttp/guzzle versions before 7.15.1 have a vulnerability where host-only cookies are not properly preserved. Instead of marking cookies as host-only, the request host is stored in the Domain field. This flaw allows attackers controlling child hosts to access host-only cookies intended for parent hosts, potentially exposing session identifiers and authorization tokens if the same cookie jar is reused across trust boundaries.

guzzlehttp/guzzle versions before 7.15.1 have an information disclosure vulnerability in the RedirectMiddleware component. When the allow_redirects.referer setting is enabled, the middleware copies the URI fragment from the referring request into the Referer header during same-scheme redirects. This can expose sensitive client data such as one-time login secrets or access tokens to unintended servers. The referer setting is disabled by default. The issue is fixed in version 7.15.1 by stripping the fragment before generating the Referer header.