Guzzle: Noncanonical host can bypass host-based checks
Summary
| CVE | CVE-2026-69246 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-03 21:16:42 UTC |
| Updated | 2026-08-03 21:16:42 UTC |
| Description | Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPT_URL to the URI exactly as written and push that Host into CURLOPT_HTTPHEADER; StreamHandler does the same through fopen(). libcurl then parses the authority itself, percent-decoding it and, on an IDN-capable build, applying IDNA mapping, and uses the result to resolve, connect, name the TLS peer and address a proxy CONNECT, while the supplied Host suppresses the aligned one libcurl would have generated. For a URI host written as 127.0.0.%31, filter_var() rejects the host as an IP literal, yet libcurl decodes it to 127.0.0.1 and reaches loopback with no DNS lookup while the server receives Host: 127.0.0.%31. An attacker who influences a fetched URI can therefore reach a host the application's checks excluded and read whatever the host exposes of the response. The same divergence moves Guzzle's own decisions onto a spelling the transport does not use: no_proxy selects proxy routing from the literal host, and RedirectMiddleware decides from it whether to strip Authorization and Cookie. Exploitation requires the application to build a request URI from untrusted input and to make a host decision before handing it to Guzzle. This issue is fixed in versions 7.15.2 and 8.0.1. |
Risk And Classification
Primary CVSS: v3.1 7.2 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Problem Types: CWE-180 | CWE-436 | CWE-918 | CWE-941 | CWE-180 CWE-180: Incorrect Behavior Order: Validate Before Canonicalize | CWE-436 CWE-436: Interpretation Conflict | CWE-918 CWE-918: Server-Side Request Forgery (SSRF) | CWE-941 CWE-941: Incorrectly Specified Destination in a Communication Channel
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 7.2 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
| 3.1 | CNA | DECLARED | 7.2 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
ChangedConfidentiality
LowIntegrity
LowAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/guzzle/guzzle/commit/744101956d78b7c1384d0cbf379db13e859167bf | [email protected] | github.com | |
| github.com/guzzle/guzzle/pull/3907 | [email protected] | github.com | |
| github.com/guzzle/guzzle/releases/tag/7.15.2 | [email protected] | github.com | |
| github.com/guzzle/guzzle/releases/tag/8.0.1 | [email protected] | github.com | |
| github.com/guzzle/guzzle/commit/3aeea0406aab88cbbd86531313d7cebf8ae149a4 | [email protected] | github.com | |
| github.com/guzzle/guzzle/security/advisories/GHSA-v5mv-p594-2x33 | [email protected] | github.com | |
| github.com/guzzle/guzzle/pull/3908 | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.