Skip to content
RequestGuard Vulnerabilities
Pricing
Vulnerability intelligence Composer

guzzlehttp/guzzle

Guzzle is a PHP HTTP client library

Composer latest 8.2.0 MIT

Evidence path

Version, exploitation, severity

RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.

1

Latest version

8.2.0

No matching published advisory returned

2

Known exploitation

No KEV match

Checked by exact CVE identifier

3

Highest advisory severity

High

14 active advisories

Check an exact version

The registry confirms the version, then OSV checks advisories for that exact value.

Published records

Advisories

14
GHSA-v5mv-p594-2x33 high

Guzzle: Noncanonical host can bypass host-based checks

Affected range

ECOSYSTEM: introduced 0; fixed 7.15.2ECOSYSTEM: introduced 8.0.0; fixed 8.0.1>=8.0.0,<8.0.1|<7.15.2

Fixed versions: 7.15.2, 8.0.1

CVE-2026-69246 Source ↗Source ↗
GHSA-25mq-v84q-4j7r high

CURLOPT_HTTPAUTH option not cleared on change of origin

Affected range

ECOSYSTEM: introduced 0; fixed 6.5.8ECOSYSTEM: introduced 7.0.0; fixed 7.4.5>=7,<7.4.5|>=4,<6.5.8

Fixed versions: 6.5.8, 7.4.5

CVE-2022-31090 Source ↗Source ↗
GHSA-q559-8m2m-g699 high

Change in port should be considered a change in origin

Affected range

ECOSYSTEM: introduced 0; fixed 6.5.8ECOSYSTEM: introduced 7.0.0; fixed 7.4.5>=7,<7.4.5|>=4,<6.5.8

Fixed versions: 6.5.8, 7.4.5

CVE-2022-31091 Source ↗Source ↗
GHSA-m6ch-gg5f-wxx3 high

HTTP Proxy header vulnerability

Affected range

ECOSYSTEM: introduced 6; fixed 6.2.1ECOSYSTEM: introduced 4.0.0-rc2; fixed 4.2.4ECOSYSTEM: introduced 5; fixed 5.3.1>=6,<6.2.1|>=4.0.0-rc2,<4.2.4|>=5,<5.3.1

Fixed versions: 6.2.1, 4.2.4, 5.3.1

CVE-2016-5385 Source ↗Source ↗
GHSA-f7vp-7xgx-4w4r moderate

Guzzle: Noncanonical cookie domain keeps subdomain scope

Affected range

ECOSYSTEM: introduced 0; fixed 7.15.2ECOSYSTEM: introduced 8.0.0; fixed 8.0.1>=8.0.0,<8.0.1|<7.15.2

Fixed versions: 7.15.2, 8.0.1

CVE-2026-69245 Source ↗Source ↗