DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-69246: CVE-2026-69246: Host Validation Bypass in Guzzle HTTP Client Leading to SSRF

#security #cve #cybersecurity

CVE-2026-69246: Host Validation Bypass in Guzzle HTTP Client Leading to SSRF

Vulnerability ID: CVE-2026-69246
CVSS Score: 7.2
Published: 2026-08-03

CVE-2026-69246 is a host validation bypass vulnerability in the Guzzle PHP HTTP client. The flaw resides in Guzzle's core HTTP transport handlers (cURL and PHP stream wrappers). Under specific conditions, a parser differential occurs between the host validation layer and the underlying network transport library (e.g., libcurl), allowing remote attackers to bypass SSRF filters, proxy routing rules, and redirect protections via crafted noncanonical URI representations.

TL;DR

Host validation bypass in Guzzle allows SSRF and proxy routing bypass by exploiting differences in how Guzzle and underlying transport libraries parse noncanonical URI hostnames.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-436 (Interpretation Conflict)
  • Attack Vector: Network
  • CVSS v3.1: 7.2 (High)
  • Exploit Status: Proof of Concept
  • KEV Status: Not Listed
  • Impact: Server-Side Request Forgery (SSRF) / Information Disclosure

Affected Systems

  • Guzzle HTTP Client < 7.15.2
  • Guzzle HTTP Client 8.0.0
  • Guzzle: < 7.15.2 (Fixed in: 7.15.2)
  • Guzzle: >= 8.0.0, < 8.0.1 (Fixed in: 8.0.1)

Code Analysis

Commit: 3aeea04

Fix host validation and prevent noncanonical hostnames in Guzzle 8.x branch

Commit: 7441019

Fix host validation and prevent noncanonical hostnames in Guzzle 7.x branch

Mitigation Strategies

  • Upgrade Guzzle to version 7.15.2 or 8.0.1 to activate the HostValidator mechanism.
  • Perform active DNS resolution on target URLs within application logic before passing them to the HTTP client.
  • Validate resolved target IP addresses using PHP's native FILTER_VALIDATE_IP with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE.

Remediation Steps:

  1. Identify all Composer dependencies matching guzzlehttp/guzzle.
  2. Execute the update command: composer update guzzlehttp/guzzle.
  3. Verify the installed version is either >= 7.15.2 or >= 8.0.1.
  4. Deploy code modifications to enforce DNS resolution validation on custom webhook and SSRF-sensitive endpoints.

References

Read the full report for CVE-2026-69246 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)