Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPT_URL to the URI exactly as written and push that Host into CURLOPT_HTTPHEADER; StreamHandler does the same through fopen(). libcurl then parses the authority itself, percent-decoding it and, on an IDN-capable build, applying IDNA mapping, and uses the result to resolve, connect, name the TLS peer and address a proxy CONNECT, while the supplied Host suppresses the aligned one libcurl would have generated. For a URI host written as 127.0.0.%31, filter_var() rejects the host as an IP literal, yet libcurl decodes it to 127.0.0.1 and reaches loopback with no DNS lookup while the server receives Host: 127.0.0.%31. An attacker who influences a fetched URI can therefore reach a host the application's checks excluded and read whatever the host exposes of the response. The same divergence moves Guzzle's own decisions onto a spelling the transport does not use: no_proxy selects proxy routing from the literal host, and RedirectMiddleware decides from it whether to strip Authorization and Cookie. Exploitation requires the application to build a request URI from untrusted input and to make a host decision before handing it to Guzzle. This issue is fixed in versions 7.15.2 and 8.0.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-03 | 3 | Disclosure1General2 |
| 2026-08-04 | 2 | Disclosure2 |
CVE-2026-69246 Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL… https://www.cve.org/CVERecord?id=CVE-2026-69246
Post summary
The post notes that Guzzle versions prior to 7.15.2 and 8.0.1 are impacted by CVE‑2026‑69246, implying a fix in those releases, but provides no PoC, exploit, or active exploitation details.
🚨High - Guzzle Host/URI Mismatch SSRF via Percent-Decoding/IDNA (CVE-2026-69246) In guzzlehttp/guzzle, the request URI host vs Host header can diverge when the underlying transport (e.g., libcurl) percent-decodes or IDNA-maps the host. Attackers can craft a fetched URI that bypasses host allow/deny checks and reach blocked targets (incl. loopback), impacting proxy/redirect/auth decisions and exposing response data. 👉Affected: guzzlehttp/guzzle < 7.15.2 (7.x), < 8.0.1 (8.x) | Upgrade to 7.15.2 / 8.0.1
Post summary
A new high‑severity SSRF vulnerability (CVE‑2026‑69246) in Guzzle allows attackers to bypass host allow/deny checks via percent‑decoding/IDNA mapping; affected versions are <7.15.2 and <8.0.1, with upgrade recommended.
CVE-2026-69246 - Guzzle HTTP client mishandles Host header via libcurl IDNA/decoding, leading to request smuggling/SSRF. CVSS 7.2. No patch yet; upgrade when fixed. #CVE #PHP #infosec https://www.valtersit.com/cve/CVE-2026-69246 #CVE #Linux #infosec #infosec #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu
Post summary
The post announces CVE‑2026‑69246, detailing a Host header mishandling in Guzzle that can cause request smuggling/SSRF; no patch is yet available and no exploit or PoC is disclosed.
🚨*CVE* CVE-2026-69246 Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL… https://www.cve.org/CVERecord?id=CVE-2026-69246 ----- Traducción: CVE-2026-69246 Guz… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-69246 in Guzzle, noting a transport‑URI handling issue, and provides a link to the CVE record; it offers no exploit details, patches or evidence of active exploitation.
Guzzle CVE-2026-69246: Κρίσιμη ευπάθεια παρακάμπτει ελέγχους host https://secn.ws/P4qvCf
Post summary
The excerpt merely announces the existence of CVE‑2026‑69246 with a critical severity claim, providing no actionable details or evidence of exploitation.