PHP package security
Is guzzlehttp/guzzle vulnerable?
15 known security advisories for guzzlehttp/guzzle. The latest was reported on 2026-08-03 and is fixed in 7.15.2 and 8.0.1. The newest release, 8.3.1, is not affected by any of them.
7 high 8 medium
- Known advisories
- 15
- Newest release
- 8.3.1
- Released
- 2026-10-25
- Affecting newest release
- 0
- Last synced
- 2026-11-03
Check your version
Security advisories for guzzlehttp/guzzle
| Reported | Advisory | Severity | Affected | Fixed in |
|---|---|---|---|---|
| 2026-08-03 | Guzzle: Noncanonical host can bypass host-based checks GHSA-v5mv-p594-2x33 · CVE-2026-69246 · GitHub | high | >=8.0.0,<8.0.1 | <7.15.2 | 7.15.2, 8.0.1 |
| 2026-08-03 | Guzzle: Noncanonical cookie domain keeps subdomain scope GHSA-f7vp-7xgx-4w4r · CVE-2026-69245 · GitHub | medium | >=8.0.0,<8.0.1 | <7.15.2 | 7.15.2, 8.0.1 |
| 2026-07-20 | Guzzle: URI fragments disclosed in redirect Referer headers GHSA-h95v-h523-3mw8 · CVE-2026-67354 · GitHub | medium | <7.15.1 | 7.15.1 |
| 2026-07-20 | Guzzle: Host-only cookie scope is not preserved GHSA-wm3w-8rrp-j577 · CVE-2026-67355 · GitHub | medium | <7.15.1 | 7.15.1 |
| 2026-07-20 | Guzzle: Unbounded response cookies risk denial of service GHSA-f283-ghqc-fg79 · CVE-2026-67353 · GitHub | medium | <7.15.1 | 7.15.1 |
| 2026-07-20 | Guzzle: Cookie Disclosure and Injection via IP-Address Domains GHSA-g446-98w2-8p5w · CVE-2026-59883 · GitHub | medium | <7.12.3 | 7.12.3 |
| 2026-07-20 | Guzzle: Proxy-Authorization headers can be sent to origin servers GHSA-94pj-82f3-465w · CVE-2026-67339 · GitHub | medium | <7.14.2 | 7.14.2 |
| 2026-06-18 | Silent HTTPS proxy downgrade to cleartext CVE-2026-55568 · GitHub, FriendsOfPHP/security-advisories | medium | <7.12.1 | 7.12.1 |
| 2026-06-18 | Dot-only cookie domains match all hosts CVE-2026-55767 · GitHub, FriendsOfPHP/security-advisories | medium | <7.12.1 | 7.12.1 |
| 2022-06-20 | Change in port should be considered a change in origin CVE-2022-31091 · GitHub, FriendsOfPHP/security-advisories | high | >=7,<7.4.5 | >=4,<6.5.8 | 6.5.8, 7.4.5 |
| 2022-06-20 | CURLOPT_HTTPAUTH option not cleared on change of origin CVE-2022-31090 · GitHub, FriendsOfPHP/security-advisories | high | >=7,<7.4.5 | >=4,<6.5.8 | 6.5.8, 7.4.5 |
| 2022-06-09 | Failure to strip the Cookie header on change in host or HTTP downgrade CVE-2022-31042 · GitHub, FriendsOfPHP/security-advisories | high | >=7,<7.4.4 | >=4,<6.5.7 | 6.5.7, 7.4.4 |
| 2022-06-09 | Fix failure to strip Authorization header on HTTP downgrade CVE-2022-31043 · GitHub, FriendsOfPHP/security-advisories | high | >=7,<7.4.4 | >=4,<6.5.7 | 6.5.7, 7.4.4 |
| 2022-05-25 | Cross-domain cookie leakage CVE-2022-29248 · GitHub, FriendsOfPHP/security-advisories | high | >=7,<7.4.3 | >=4,<6.5.6 | 6.5.6, 7.4.3 |
| 2016-07-15 | HTTP Proxy header vulnerability CVE-2016-5385 · GitHub, FriendsOfPHP/security-advisories | high | >=6,<6.2.1 | >=4.0.0-rc2,<4.2.4 | >=5,<5.3.1 | 4.2.4, 5.3.1, 6.2.1 |
Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.
Ask about a fixCheck your whole project. Paste your composer.lock and see every installed package with a known advisory. Nothing is stored.
Check composer.lockQuestions about guzzlehttp/guzzle
Does guzzlehttp/guzzle have known vulnerabilities?
Yes. Packagist lists 15 security advisories for guzzlehttp/guzzle (7 high, 8 medium severity). The most recent, reported 2026-08-03, is "Guzzle: Noncanonical host can bypass host-based checks". The newest release, 8.3.1, is outside every affected range.
Which version of guzzlehttp/guzzle should I run?
The newest stable release is 8.3.1 (published 2026-10-25). The most recent advisory is fixed in 7.15.2 and 8.0.1, so stay on or above the fixed version for your major version. Run composer update guzzlehttp/guzzle, then composer audit to confirm nothing else is flagged.
How do I check if my guzzlehttp/guzzle version is affected?
Run composer show guzzlehttp/guzzle in your project to see the installed version, then enter it in the version check on this page. You can also run composer audit, which reads the same Packagist advisory data for every package in your composer.lock.