Résumé
Duplicate Advisory: Guzzle: Proxy-Authorization headers can be sent to origin servers
Détails de l’avis
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-94pj-82f3-465w. This link is maintained to preserve external references.
Original Description
guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as direct connections.
Références
Vulnérabilités liées
Tout Supply chain →- HIGHCVE-2026-75912
CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval
- HIGHCVE-2026-75915
CodeWhale: js_execution leaks parent environment to model context via missing env scrub
- HIGHCVE-2026-75859
CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository
- HIGHCVE-2026-72804
SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents
- MEDIUMCVE-2026-61842
Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)
- MEDIUMCVE-2026-73229
Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests