Source Package: guzzle (7.4.5-1)
Guzzle is a PHP HTTP client library
The following binary packages are built from this source package:
- php-guzzlehttp-guzzle
Guzzle is a PHP HTTP client library
Packages / Debian 12 (Bookworm) / Source / php / guzzle
Known vulnerabilities
Matching against OpenFactory catalog package versions is in progress.
| CVE | Severity | Version impact |
|---|---|---|
| [CVE-2026-69246] Published: Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPT_URL to the U | High(7.2) | AffectedDetails (2)
|
| [CVE-2026-69245] Published: Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain() gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain() recognizes the Dom | Medium(6.5) | AffectedDetails (2)
|
| [CVE-2026-67354] Published: guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allow_redirects.referer setting is enabled, the middleware copies the | High(8.2) | AffectedDetails (2)
|
| [CVE-2026-67355] Published: guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child host | High(8.2) | AffectedDetails (2)
|
| [CVE-2026-67353] Published: guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many | Medium(6.9) | AffectedDetails (2)
|
| [CVE-2026-67339] Published: guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access | Medium(6.9) | AffectedDetails (2)
|
| [CVE-2026-59883] Published: Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain values to the exact host that set them, because SetCookie::matc | Medium(4.7) | AffectedDetails (2)
|
| [CVE-2026-55767] Published: Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar incorrectly accepts cookies with a dot-only Domain attribute and whitespace-padded variants. SetCookie::matchesDomain() removes lead | High(7.2) | AffectedDetails (2)
|
| [CVE-2026-55568] Published: Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in certain configurations, traffic expected to be protected by TLS on the hop to the proxy is transmitted in cleartext. Proxy authentication c | Medium(5.9) | AffectedDetails (2)
|
| [CVE-2022-31090] Published: guzzle: CVE-2022-31090 | High(7.7) | Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Details (2)
|
| [CVE-2022-31043] Published: guzzle: CVE-2022-31043 | High(7.5) | Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Details (2)
|
| [CVE-2022-29248] Published: Not reported guzzle: CVE-2022-29248 | Medium | Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Details (2)
|
| [CVE-2022-31042] Published: Not reported guzzle: CVE-2022-31042 | Medium | Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Details (2)
|
| [CVE-2022-31091] Published: Not reported guzzle: CVE-2022-31091 | Medium | Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Details (2)
|
Last synced:
Sources
- Debian 12 (Bookworm) main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
bookworm-main-amd64:9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
Repository-signature verification record- Signed-object SHA-256
- 77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
- Signer fingerprint
- 4CB50190207B4758A3F73A796ED0E7B82643E131
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-amd64/Packages.xz
- Expected SHA-256
- 9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
- Observed SHA-256
- 9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
- Result
- match verified
- Debian 12 (Bookworm) main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
bookworm-main-arm64:2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
Repository-signature verification record- Signed-object SHA-256
- 77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
- Signer fingerprint
- 4CB50190207B4758A3F73A796ED0E7B82643E131
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-arm64/Packages.xz
- Expected SHA-256
- 2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
- Observed SHA-256
- 2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
- Result
- match verified