CVE-2026-55568

Name of the Vulnerable Software and Affected Versions Guzzle versions prior to 7.12.1

Description In certain configurations, traffic intended to be protected by TLS on the hop to the proxy is transmitted in cleartext. This occurs when an application uses the built-in cURL handlers (GuzzleHttpHandlerCurlHandler and GuzzleHttpHandlerCurlMultiHandler) with an https:// proxy while running on libcurl versions older than 7.50.2, which silently treat HTTPS proxies as plaintext HTTP proxies. Consequently, proxy authentication credentials—including the Proxy-Authorization header, proxy userinfo in the proxy URL, or CURLOPT PROXYUSERPWD—are sent without encryption. Additionally, the CONNECT target host and port for tunneled HTTPS requests are exposed, and for plain HTTP requests, both headers and bodies are exposed on the proxy leg.

Recommendations Update Guzzle to version 7.12.1 or later. As a temporary workaround, do not configure an https:// proxy on installations where libcurl lacks HTTPS-proxy support and verify the capability in application code before use. Upgrade the system libcurl to version 7.52.0 or newer built with HTTPS-proxy support.