Insufficiently Protected Credentials Affecting guzzlehttp/guzzle package, versions <7.14.2
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-GUZZLEHTTPGUZZLE-18306770
- published25 Jul 2026
- disclosed20 Jul 2026
- creditGrahamCampbell
Introduced: 20 Jul 2026
CVE-2026-67339 (opens in a new tab)How to fix?
Upgrade guzzlehttp/guzzle to version 7.14.2 or higher.
Overview
Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the handling of Proxy-Authorization headers by the cURL handlers and stream handler. An attacker can obtain proxy credentials by controlling the origin server and capturing the credentials sent inappropriately to the origin, potentially through crafted redirects or by manipulating proxy configurations. This is only exploitable if a first-class Proxy-Authorization header is configured and the application issues direct, bypassed, or SOCKS requests, or follows redirects into those routes.
Workaround
This vulnerability can be mitigated by removing first-class Proxy-Authorization fields from requests, client defaults, and middleware, and instead supplying proxy credentials through proxy URL userinfo or CURLOPT_PROXYUSERPWD with the cURL handlers. Avoid combining proxy URL userinfo with a first-class field or a raw stream_context.http.proxy override. If a first-class field is unavoidable, use libcurl 7.37.0 or newer with CURLOPT_PROXYHEADER, CURLOPT_HEADEROPT, and CURLHEADER_SEPARATE, and ensure the field is never present on a client that can issue direct, bypassed, or SOCKS requests or follow redirects into those routes.