PHP HTTP Client Vulnerability in Guzzle by Devs

CVE-2026-69246

What is CVE-2026-69246?

Guzzle, a popular PHP HTTP client, contains a vulnerability that arises from the way it handles request URIs. Versions prior to 7.15.2 and 8.0.1 supply the request URI as plain text, while treating the Host header separately. This discrepancy allows an attacker to manipulate the URI and bypass the application’s input validation, effectively enabling unauthorized access to targeted resources. In situations where an application relies on untrusted input to build request URIs, the risk of exploitation increases significantly, revealing the potential for unauthorized data exposure. A fix has been implemented in the latest versions of Guzzle, addressing the improper management of host and URI details.

References