---
id: CVE-2026-67339
title: >-
  guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate
  Proxy-Authorization headers from origin servers in cURL handlers
summary: >-
  guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate
  Proxy-Authorization headers from origin servers in cURL handlers. Attackers
  can capture proxy credentials through origin server access logs when requests
  are redirected, b…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-200
published: '2026-08-01'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:35:01.260'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67339'
references:
  - url: 'https://github.com/guzzle/guzzle/security/advisories/GHSA-94pj-82f3-465w'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/guzzlehttp-guzzle-before-proxy-authorization-header-disclosure
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00372
epssPercentile: 0.2835
ingestedAt: '2026-08-02T09:18:11.563Z'
---

## Overview

guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as direct connections.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.