guzzlehttp/guzzle Security Advisories for 7.15.0 (5)
-
[HIGH] Guzzle: Noncanonical host can bypass host-based checks
PKSA-gcrk-3vtt-1r14 CVE-2026-69246 GHSA-v5mv-p594-2x33
Affected version: >=8.0.0,<8.0.1|<7.15.2
Reported by:
GitHub -
[MEDIUM] Guzzle: Noncanonical cookie domain keeps subdomain scope
PKSA-cnw1-2ytm-cgr8 CVE-2026-69245 GHSA-f7vp-7xgx-4w4r
Affected version: >=8.0.0,<8.0.1|<7.15.2
Reported by:
GitHub -
[MEDIUM] Guzzle: URI fragments disclosed in redirect Referer headers
PKSA-fy2t-3c5f-827y CVE-2026-67354 GHSA-h95v-h523-3mw8
Affected version: <7.15.1
Reported by:
GitHub -
[MEDIUM] Guzzle: Host-only cookie scope is not preserved
PKSA-qxvb-2bpp-dnk6 CVE-2026-67355 GHSA-wm3w-8rrp-j577
Affected version: <7.15.1
Reported by:
GitHub -
[MEDIUM] Guzzle: Unbounded response cookies risk denial of service
PKSA-bbs6-q5q9-f3t4 CVE-2026-67353 GHSA-f283-ghqc-fg79
Affected version: <7.15.1
Reported by:
GitHub