Guzzle CVE-2026-69246 is a critical, high-severity vulnerability in the popular HTTP library for PHP, which can bypass hostname-based checks. The SecNews technical team is investigating the risk and protective steps.
The issue is reported as CVE-2026-69246 and concerns the guzzlehttp/guzzle, which is widely used in PHP applications to send requests to external services. The vulnerability is rated High and could allow a remote attacker, under certain conditions, to redirect an application to a destination other than what the initial checks allowed.
See also: Bouncy Castle Java: Five new vulnerabilities require immediate upgrade
How Guzzle works CVE-2026-69246
Guzzle passes the request URI as text to the transport layer, while passing the Host. The built-in cURL and StreamHandler handlers do not always interpret these two elements in the same way. libcurl can decode the authority of the URI and connect to a canonical destination, while the application still evaluates the uncanonical name.
So, an address like 127.0.0.%31 might pass a check that doesn't consider it an IP literal, while libcurl might interpret it as 127.0.0.1. The example is important because the server might receive a different value in the Host header than the one used for the connection. The same discrepancy affects proxy options, redirects, and the handling of sensitive headers.
Guzzle's official security bulletin on GitHub clarifies that this is not a general SSRF protection. The risk occurs when the application constructs a URI from an untrusted input and first decides whether the host belongs to a restricted or private domain.
Which versions are affected?
CVE -2026-69246 affects branch 7 versions prior to 7.15.2, as well as version 8.0.0. The patched version is 7.15.2 for the previous series and 8.0.1 for version 8. The update adds checks to the three basic operators before any network communication and drops suspicious host formats and explicit Host headers.
The fixes check for, among other things, characters outside the ASCII range, percent encodings, authority section delimiters, unbalanced brackets, and certain numeric formats ending in a period. In addition, the library can recreate the Host header when rewriting the URI, so that the connection details remain consistent.
See also: N-central CVE-2026-18577: New N-able hotfix for administrators
What should administrators do?
For Guzzle CVE-2026-69246, the priority is to upgrade the package to the appropriate patched version and restart applications that keep the library loaded in memory. Development teams should check the Composer lock file, container images, and automated deployment processes to ensure that no old copy is left in any environment.
Security managers can also look in the logs for requests with unusual host formats, encoded characters, or attempts to access loopbacks and private addresses. Redirects require special attention, because an initially valid URI can lead to a different destination in the next step. Recording final destinations, DNS responses, and headers helps in investigating suspicious requests.
Where the upgrade is delayed, strict validation of the URI is needed before it is handed over to Guzzle. Validation should be applied to each redirect, checking the explicit Host header separately, and examining the final IP address when the application is protecting internal services. For untrusted origins, it is wise to use a separate cookie store and a limited list of allowed hosts.
Enabling idn_conversion is not an access control mechanism in itself. Also, the Uri::getHost() returns the host as written, not necessarily the destination to which the transport layer will connect. These details should be captured in tests and monitoring rules.
See also: Cisco FMC Zero-Day: Active Exploit and Critical Vulnerability
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
After installation, a controlled test should confirm that the same rules apply to the cURL handler and StreamHandler. Also check the versions used indirectly by other Composer packages, as a direct update to a single project is not enough if an old copy remains in a shared image or service.
So far, the publicly available technical description does not document exploitation in real attacks. However, Guzzle CVE-2026-69246 concerns a component found in many applications, and the exploitation of non-standard hosts can affect access controls, redirects, and credentials. The SecNews editorial team recommends immediately checking dependencies and applying the update without waiting.
