porro
Start free trial
Product
Needs attention Checks Setup Updates Alerts Tour the product →
Connectors
Laravel Filament Statamic Craft CMS JavaScript One-click install WordPress · soon All connectors →
Security Pricing

Free tools and reference

Lock-file checker Advisories End of life Blog Log in

Advisories  /  composer  /  guzzlehttp

composer

guzzlehttp/guzzle

Security advisories for guzzlehttp/guzzle, newest first. 15 known, all fixed. If you’re on 8.0.1 or later, none of them affect you.

RSS feed Check your lock file →

Latest version

8.3.1

Advisories

15 · 0 unfixed

Last advisory

3 Aug 2026

Safe from

8.0.1

15 advisories · newest first

HIGH7.2 3 Aug 2026

Guzzle: Noncanonical host can bypass host-based checks

GHSA-v5mv-p594-2x33 · CVE-2026-69246

Affected

< 7.15.2 ≥ 8.0.0, < 8.0.1

Fixed in

7.15.2 8.0.1
MODERATE6.5 3 Aug 2026

Guzzle: Noncanonical cookie domain keeps subdomain scope

GHSA-f7vp-7xgx-4w4r · CVE-2026-69245

Affected

< 7.15.2 ≥ 8.0.0, < 8.0.1

Fixed in

7.15.2 8.0.1
MODERATE5.9 20 Jul 2026

Guzzle: URI fragments disclosed in redirect Referer headers

GHSA-h95v-h523-3mw8 · CVE-2026-67354

Affected

< 7.15.1

Fixed in

7.15.1
MODERATE5.9 20 Jul 2026

Guzzle: Host-only cookie scope is not preserved

GHSA-wm3w-8rrp-j577 · CVE-2026-67355

Affected

< 7.15.1

Fixed in

7.15.1
MODERATE5.3 20 Jul 2026

Guzzle: Unbounded response cookies risk denial of service

GHSA-f283-ghqc-fg79 · CVE-2026-67353

Affected

< 7.15.1

Fixed in

7.15.1
MODERATE4.7 20 Jul 2026

Guzzle: Cookie Disclosure and Injection via IP-Address Domains

GHSA-g446-98w2-8p5w · CVE-2026-59883

Affected

< 7.12.3

Fixed in

7.12.3
MODERATE5.3 20 Jul 2026

Guzzle: Proxy-Authorization headers can be sent to origin servers

GHSA-94pj-82f3-465w · CVE-2026-67339

Affected

< 7.14.2

Fixed in

7.14.2
MODERATE5.9 18 Jun 2026

Silent HTTPS proxy downgrade to cleartext

GHSA-wpwq-4j6v-78m3 · CVE-2026-55568

Affected

< 7.12.1

Fixed in

7.12.1
MODERATE5.8 18 Jun 2026

Dot-only cookie domains match all hosts

GHSA-cwxw-98qj-8qjx · CVE-2026-55767

Affected

< 7.12.1

Fixed in

7.12.1
HIGH7.7 20 Jun 2022

Change in port should be considered a change in origin

GHSA-q559-8m2m-g699 · CVE-2022-31091

Affected

≥ 4, < 6.5.8 ≥ 7, < 7.4.5

Fixed in

6.5.8 7.4.5
HIGH7.7 20 Jun 2022

CURLOPT_HTTPAUTH option not cleared on change of origin

GHSA-25mq-v84q-4j7r · CVE-2022-31090

Affected

≥ 4, < 6.5.8 ≥ 7, < 7.4.5

Fixed in

6.5.8 7.4.5
HIGH7.5 9 Jun 2022

Failure to strip the Cookie header on change in host or HTTP downgrade

GHSA-f2wf-25xc-69c9 · CVE-2022-31042

Affected

≥ 4, < 6.5.7 ≥ 7, < 7.4.4

Fixed in

6.5.7 7.4.4
HIGH7.5 9 Jun 2022

Fix failure to strip Authorization header on HTTP downgrade

GHSA-w248-ffj2-4v5q · CVE-2022-31043

Affected

≥ 4, < 6.5.7 ≥ 7, < 7.4.4

Fixed in

6.5.7 7.4.4
HIGH8.0 25 May 2022

Cross-domain cookie leakage

GHSA-cwmx-hcrq-mhc3 · CVE-2022-29248

Affected

≥ 4, < 6.5.6 ≥ 7, < 7.4.3

Fixed in

6.5.6 7.4.3
HIGH8.1 15 Jul 2016

HTTP Proxy header vulnerability

PKSA-stmn-hvzq-wph6 · CVE-2016-5385

Affected

≥ 4.0.0-rc2, < 4.2.4 ≥ 5, < 5.3.1 ≥ 6, < 6.2.1

Fixed in

4.2.4 5.3.1 6.2.1
/advisories/composer/guzzlehttp/guzzle/feed.rss

From Packagist and the GitHub advisory database · synced hourly

Same vendor

guzzlehttp/psr76 advisories

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →