UBUNTU-CVE-2026-67339

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-67339

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-67339.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-67339

Upstream

CVE-2026-67339

Published

2026-08-01T13:17:00Z

Modified

2026-08-06T00:23:23Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as direct connections.

References

Affected packages

Ubuntu:24.04:LTS / guzzle

Package

Name: guzzle
Purl: pkg:deb/ubuntu/guzzle?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

7.*

7.4.5-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "php-guzzlehttp-guzzle",
            "binary_version": "7.4.5-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-67339.json"

Ubuntu:26.04:LTS / guzzle