What’s Vulnerable › Products

guzzle vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your guzzle version is affected

Latest guzzle vulnerabilities

• CVE-2026-69246 — Guzzle: Noncanonical host can bypass host-based checks (CVSS 7.2)
• CVE-2026-69245 — Guzzle: Noncanonical cookie domain keeps subdomain scope (CVSS 6.5)
• CVE-2026-67355 — guzzlehttp/guzzle before 7.15.1 Host-only Cookie Scope (CVSS 5.9)
• CVE-2026-67354 — guzzlehttp/guzzle before 7.15.1 URI Fragment Disclosure via Referer (CVSS 5.9)
• CVE-2026-67353 — guzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of Service (CVSS 5.3)
• CVE-2026-67339 — guzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure (CVSS 5.3)
• CVE-2026-59883 — Guzzle: Cookie Disclosure and Injection via IP-Address Domains (CVSS 6.1)
• CVE-2026-55767 — Guzzle: Dot-Only Cookie Domains Match All Hosts in guzzlehttp/guzzle (CVSS 5.8)
• CVE-2026-55568 — Guzzle: Silent HTTPS-Proxy Downgrade to Cleartext (CVSS 5.9)
• CVE-2022-31091 — Change in port should be considered a change in origin in Guzzle (CVSS 7.7)
• CVE-2022-31090 — CURLOPT_HTTPAUTH option not cleared on change of origin in Guzzle (CVSS 7.7)
• CVE-2022-31043 — Fix failure to strip Authorization header on HTTP downgrade in Guzzle (CVSS 7.5)
• CVE-2022-31042 — Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle (CVSS 7.5)
• CVE-2022-29248 — Cross-domain cookie leakage in Guzzle (CVSS 8.1)