CVE-2026-67339

Name of the Vulnerable Software and Affected Versions guzzlehttp/guzzle versions prior to 7.14.2

Description The built-in cURL handlers (CurlHandler and CurlMultiHandler) fail to properly isolate Proxy-Authorization headers from origin servers. This occurs because the handlers place first-class request headers into the origin header list (CURLOPT HTTPHEADER) and only move them to the proxy-only list (CURLOPT PROXYHEADER) when an HTTP or HTTPS proxy is predicted. Consequently, proxy credentials may be sent to the origin server if the request is direct, bypassed via no proxy settings, sent through a SOCKS proxy, or redirected from a proxied hop to a non-proxied route.

On systems with libcurl older than 7.37.0 or PHP cURL extensions lacking CURLOPT PROXYHEADER, CURLOPT HEADEROPT, and CURLHEADER SEPARATE, no proxy-only channel is available, leaving the header in the origin list for all routes. Additionally, the stream handler may expose credentials when combined with raw stream context.http.proxy overrides.

An attacker controlling the origin server can capture these private credentials through access logs or tracing systems. This could allow the attacker to abuse access-controlled proxies or impersonate the proxy principal.

Recommendations Update guzzlehttp/guzzle to version 7.14.2. As a temporary workaround, remove first-class Proxy-Authorization fields from requests, client defaults, and middleware, and instead provide proxy credentials via proxy URL userinfo (e.g., http://user:pass@proxy.example:8080) or use CURLOPT PROXYUSERPWD with cURL handlers. Avoid combining proxy URL userinfo with first-class fields or raw stream context.http.proxy overrides.