curl: Incomplete IDN hostname check on the transfer path can lead to credential disclosure to an unintended host

Summary The fix that rejects URL-separator characters introduced by IDN decoding hostnamecheck after hostdecode was applied only to the curlurlget getter path. The transfer path still IDN-decodes the URL host with libidn2 and stores the result without any hostnamecheck. Because libidn2 maps U+FF2...

PT-2026-67523

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPT URL to the URI exactly as written and push that Host into CURLOPT HTTPHEADER; StreamHandler does the same...