CVE-2026-67339 Details
Description
guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as direct connections.
A vulnerability exists in GuzzleHTTP Guzzle versions prior to 7.14.2, where the cURL handlers do not properly separate Proxy-Authorization headers from origin server requests. This flaw allows attackers to intercept proxy credentials through origin server access logs under certain conditions, such as when requests are redirected, bypassed, or routed through SOCKS proxies that Guzzle incorrectly identifies as direct connections.
Users can upgrade to Guzzle version 7.14.2 or later, where this issue is fixed. If an immediate upgrade is not possible, first-class Proxy-Authorization headers can be removed from requests, client defaults, and middleware. Instead, proxy credentials can be supplied through proxy URL userinfo or using CURLOPT_PROXYUSERPWD with the cURL handlers.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 1, 2026 | New CVE Received | [email protected] |