Packagist/guzzlehttp/guzzle

Fix failure to strip Authorization header on HTTP downgrade

Modified: 12/10/2025

CURLOPT_HTTPAUTH option not cleared on change of origin

Modified: 2/16/2024

Guzzle: Proxy-Authorization headers can be sent to origin servers

Modified: 9/10/2026

Cross-domain cookie leakage in Guzzle

Modified: 12/10/2025

guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts

Modified: 9/10/2026

Guzzle: Unbounded response cookies risk denial of service

Modified: 9/10/2026

Failure to strip the Cookie header on change in host or HTTP downgrade

Modified: 12/10/2025

Guzzle: Noncanonical cookie domain keeps subdomain scope

Modified: 9/10/2026

Guzzle: Cookie Disclosure and Injection via IP-Address Domains

Modified: 9/10/2026

Guzzle: URI fragments disclosed in redirect Referer headers

Modified: 9/10/2026

HTTP Proxy header vulnerability

Modified: 11/8/2023

Change in port should be considered a change in origin

Modified: 11/8/2023

Guzzle: Noncanonical host can bypass host-based checks

Modified: 9/10/2026

Guzzle: Host-only cookie scope is not preserved

Modified: 9/10/2026

guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext

Modified: 9/10/2026