Composer guzzlehttp/guzzle has 15 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2016-5385 | HTTP Proxy header vulnerability | high | 8.1 | >=6 and <6.2.1 or >=4.0.0-rc2 and <4.2.4 or >=5 and <5.3.1 | 6.2.1, 4.2.4, 5.3.1 |
| CVE-2022-31042 | Failure to strip the Cookie header on change in host or HTTP downgrade | high | 7.5 | >=4.0.0 and <6.5.7 or >=7.0.0 and <7.4.4 or >=7 and <7.4.4 or >=4 and <6.5.7 | 6.5.7, 7.4.4 |
| CVE-2022-31043 | Fix failure to strip Authorization header on HTTP downgrade | unknown | 0.0 | >=7 and <7.4.4 or >=4 and <6.5.7 | 7.4.4, 6.5.7 |
| CVE-2022-31090 | Authorization header leaked to a different origin on cross-origin redirect (curl handler) | high | 7.7 | >=7.0.0 and <7.4.5 or >=6.0.0 and <6.5.8 or <6.5.8 or >=7 and <7.4.5 or >=4 and <6.5.8 | 6.5.8, 7.4.5 |
| CVE-2022-31091 | Change in port not treated as a change in origin; sensitive headers leaked on redirect | high | 8.1 | >=7.0.0 and <7.4.5 or >=6.0.0 and <6.5.8 or <6.5.8 or >=7 and <7.4.5 or >=4 and <6.5.8 | 6.5.8, 7.4.5 |
| CVE-2022-29248 | Cross-domain cookie leakage in Guzzle | high | 8.0 | <6.5.6 or >=7.0.0 and <7.4.3 or >=7 and <7.4.3 or >=4 and <6.5.6 | 6.5.6, 7.4.3 |
| CVE-2026-67353 | Guzzle: Unbounded response cookies risk denial of service | medium | 5.3 | <7.15.1 | 7.15.1 |
| CVE-2026-67354 | Guzzle: URI fragments disclosed in redirect Referer headers | medium | 5.9 | <7.15.1 | 7.15.1 |
| CVE-2026-67339 | Guzzle: Proxy-Authorization headers can be sent to origin servers | medium | 5.3 | <7.14.2 | 7.14.2 |
| CVE-2026-69246 | Guzzle: Noncanonical host can bypass host-based checks | high | 7.2 | <7.15.2 or >=8.0.0 and <8.0.1 | 7.15.2, 8.0.1 |
| CVE-2026-67355 | Guzzle: Host-only cookie scope is not preserved | medium | 5.9 | <7.15.1 | 7.15.1 |
| CVE-2026-55767 | guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts | medium | 5.8 | <7.12.1 | 7.12.1 |
| CVE-2026-69245 | Guzzle: Noncanonical cookie domain keeps subdomain scope | medium | 6.5 | <7.15.2 or >=8.0.0 and <8.0.1 | 7.15.2, 8.0.1 |
| CVE-2026-59883 | Guzzle: Cookie Disclosure and Injection via IP-Address Domains | medium | 4.7 | <7.12.3 | 7.12.3 |
| CVE-2026-55568 | guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext | medium | 5.9 | <7.12.1 | 7.12.1 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked