CVE-2026-69246: Incorrect Behavior Order: Validate Before Canonicalize

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPTURL to the URI exactly as written and push that Host into CURLOPTHTTPHEADER; StreamHandler does the same throu...

Fedora 23 : php-guzzlehttp-guzzle6 (2016-9c8cf5912c) (httpoxy)

6.2.1 - 2016-07-18 - Address HTTPPROXY security vulnerability, CVE-2016-5385: https://httpoxy.org/ - Fixing timeout bug with StreamHandler: https://github.com/guzzle/guzzle/pull/1488 - Only read up to Content-Length in PHP StreamHandler to avoid timeouts when a server does not honor Connection:...

HTTP Proxy header vulnerability

Addressing HTTPPROXY security vulnerability, CVE-2016-5385: https://httpoxy.org/. Please update to this version of Guzzle in order to mitigate the vulnerability when sending Guzzle requests inside of a CGI application. - Fixing timeout bug with StreamHandler - Only read up to Content-Length in...