CVE-2026-69246
Guzzle: Noncanonical host can bypass host-based checks
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPT_URL to the URI exactly as written and push that Host into CURLOPT_HTTPHEADER; StreamHandler does the same through fopen(). libcurl then parses the authority itself, percent-decoding it and, on an IDN-capable build, applying IDNA mapping, and uses the result to resolve, connect, name the TLS peer and address a proxy CONNECT, while the supplied Host suppresses the aligned one libcurl would have generated. For a URI host written as 127.0.0.%31, filter_var() rejects the host as an IP literal, yet libcurl decodes it to 127.0.0.1 and reaches loopback with no DNS lookup while the server receives Host: 127.0.0.%31. An attacker who influences a fetched URI can therefore reach a host the application's checks excluded and read whatever the host exposes of the response. The same divergence moves Guzzle's own decisions onto a spelling the transport does not use: no_proxy selects proxy routing from the literal host, and RedirectMiddleware decides from it whether to strip Authorization and Cookie. Exploitation requires the application to build a request URI from untrusted input and to make a host decision before handing it to Guzzle. This issue is fixed in versions 7.15.2 and 8.0.1.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High7.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
| NVDNVD · Awaiting Analysis | 3.1 | High7.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.37% · top 69% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.2.
Weakness
- CWE-180: Incorrect Behavior Order: Validate Before Canonicalize (opens in a new tab)All about CWE-180 and its CVEs
- CWE-436: Interpretation Conflict (opens in a new tab)All about CWE-436 and its CVEs
- CWE-918: Server-Side Request Forgery (SSRF) (opens in a new tab)All about CWE-918 and its CVEs
- CWE-941: Incorrectly Specified Destination in a Communication Channel (opens in a new tab)All about CWE-941 and its CVEs
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Packagistguzzlehttp/guzzleGHSA-v5mv-p594-2x33 (opens in a new tab)
References (7)
- https://github.com/guzzle/guzzle/security/advisories/GHSA-v5mv-p594-2x33 (opens in a new tab)x_refsource_CONFIRM
- https://github.com/guzzle/guzzle/pull/3907 (opens in a new tab)x_refsource_MISC
- https://github.com/guzzle/guzzle/pull/3908 (opens in a new tab)x_refsource_MISC
- https://github.com/guzzle/guzzle/commit/3aeea0406aab88cbbd86531313d7cebf8ae149a4 (opens in a new tab)x_refsource_MISC
- https://github.com/guzzle/guzzle/commit/744101956d78b7c1384d0cbf379db13e859167bf (opens in a new tab)x_refsource_MISC
- https://github.com/guzzle/guzzle/releases/tag/7.15.2 (opens in a new tab)x_refsource_MISC
- https://github.com/guzzle/guzzle/releases/tag/8.0.1 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-v5mv-p594-2x33 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-69246)Record last updated .