Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPT_URL to the URI exactly as written and push that Host into CURLOPT_HTTPHEADER; StreamHandler does the same through fopen(). libcurl then parses the authority itself, percent-decoding it and, on an IDN-capable build, applying IDNA mapping, and uses the result to resolve, connect, name the TLS peer and address a proxy CONNECT, while the supplied Host suppresses the aligned one libcurl would have generated. For a URI host written as 127.0.0.%31, filter_var() rejects the host as an IP literal, yet libcurl decodes it to 127.0.0.1 and reaches loopback with no DNS lookup while the server receives Host: 127.0.0.%31. An attacker who influences a fetched URI can therefore reach a host the application's checks excluded and read whatever the host exposes of the response. The same divergence moves Guzzle's own decisions onto a spelling the transport does not use: no_proxy selects proxy routing from the literal host, and RedirectMiddleware decides from it whether to strip Authorization and Cookie. Exploitation requires the application to build a request URI from untrusted input and to make a host decision before handing it to Guzzle. This issue is fixed in versions 7.15.2 and 8.0.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request
    URI as text and supplies the Host header separately. The cURL handlers set CURLOPT_URL to the URI exactly
    as written and push that Host into CURLOPT_HTTPHEADER; StreamHandler does the same through fopen().
    libcurl then parses the authority itself, percent-decoding it and, on an IDN-capable build, applying IDNA
    mapping, and uses the result to resolve, connect, name the TLS peer and address a proxy CONNECT, while the
    supplied Host suppresses the aligned one libcurl would have generated. For a URI host written as
    127.0.0.%31, filter_var() rejects the host as an IP literal, yet libcurl decodes it to 127.0.0.1 and
    reaches loopback with no DNS lookup while the server receives Host: 127.0.0.%31. An attacker who
    influences a fetched URI can therefore reach a host the application's checks excluded and read whatever
    the host exposes of the response. The same divergence moves Guzzle's own decisions onto a spelling the
    transport does not use: no_proxy selects proxy routing from the literal host, and RedirectMiddleware
    decides from it whether to strip Authorization and Cookie. Exploitation requires the application to build
    a request URI from untrusted input and to make a host decision before handing it to Guzzle. This issue is
    fixed in versions 7.15.2 and 8.0.1. (CVE-2026-69246)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request     URI as text and supplies the Host header separately. The cURL handlers set CURLOPT_URL to the URI exactly     as written and push that Host into CURLOPT_HTTPHEADER; StreamHandler does the same through fopen().
    libcurl then parses the authority itself, percent-decoding it and, on an IDN-capable build, applying IDNA     mapping, and uses the result to resolve, connect, name the TLS peer and address a proxy CONNECT, while the     supplied Host suppresses the aligned one libcurl would have generated. For a URI host written as     127.0.0.%31, filter_var() rejects the host as an IP literal, yet libcurl decodes it to 127.0.0.1 and     reaches loopback with no DNS lookup while the server receives Host: 127.0.0.%31. An attacker who     influences a fetched URI can therefore reach a host the application's checks excluded and read whatever     the host exposes of the response. The same divergence moves Guzzle's own decisions onto a spelling the     transport does not use: no_proxy selects proxy routing from the literal host, and RedirectMiddleware     decides from it whether to strip Authorization and Cookie. Exploitation requires the application to build     a request URI from untrusted input and to make a host decision before handing it to Guzzle. This issue is     fixed in versions 7.15.2 and 8.0.1. (CVE-2026-69246)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
445612	SCA: security update for guzzlehttp/guzzle (GHSA-v5mv-p594-2x33)	Tenable Cloud Security	SCA Checks	Local	high
445612	SCA: security update for guzzlehttp/guzzle (GHSA-v5mv-p594-2x33)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
331888	Linux Distros Unpatched Vulnerability : CVE-2026-69246	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-69246

high

Tenable Plugins

high

high

high