{"uuid": "73fd7c6c-8662-4211-ad4b-26c3543c612b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69246", "type": "seen", "source": "https://gist.github.com/alon710/aa0d8e0a2033bd155210db761c2f4b38", "content": "# CVE-2026-69246: CVE-2026-69246: Host Validation Bypass in Guzzle HTTP Client Leading to SSRF\n\n> **CVSS Score:** 7.2\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69246\n\n## Summary\nCVE-2026-69246 is a host validation bypass vulnerability in the Guzzle PHP HTTP client. The flaw resides in Guzzle's core HTTP transport handlers (cURL and PHP stream wrappers). Under specific conditions, a parser differential occurs between the host validation layer and the underlying network transport library (e.g., libcurl), allowing remote attackers to bypass SSRF filters, proxy routing rules, and redirect protections via crafted noncanonical URI representations.\n\n## TL;DR\nHost validation bypass in Guzzle allows SSRF and proxy routing bypass by exploiting differences in how Guzzle and underlying transport libraries parse noncanonical URI hostnames.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-436 (Interpretation Conflict)\n- **Attack Vector**: Network\n- **CVSS v3.1**: 7.2 (High)\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n- **Impact**: Server-Side Request Forgery (SSRF) / Information Disclosure\n\n## Affected Systems\n\n- Guzzle HTTP Client < 7.15.2\n- Guzzle HTTP Client 8.0.0\n- **Guzzle**: < 7.15.2 (Fixed in: `7.15.2`)\n- **Guzzle**: >= 8.0.0, < 8.0.1 (Fixed in: `8.0.1`)\n\n## Mitigation\n\n- Upgrade Guzzle to version 7.15.2 or 8.0.1 to activate the HostValidator mechanism.\n- Perform active DNS resolution on target URLs within application logic before passing them to the HTTP client.\n- Validate resolved target IP addresses using PHP's native FILTER_VALIDATE_IP with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE.\n\n**Remediation Steps:**\n1. Identify all Composer dependencies matching guzzlehttp/guzzle.\n2. Execute the update command: composer update guzzlehttp/guzzle.\n3. Verify the installed version is either >= 7.15.2 or >= 8.0.1.\n4. Deploy code modifications to enforce DNS resolution validation on custom webhook and SSRF-sensitive endpoints.\n\n## References\n\n- [GHSA-v5mv-p594-2x33](https://github.com/guzzle/guzzle/security/advisories/GHSA-v5mv-p594-2x33)\n- [Guzzle Pull Request 3907](https://github.com/guzzle/guzzle/pull/3907)\n- [Guzzle Pull Request 3908](https://github.com/guzzle/guzzle/pull/3908)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69246) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T01:31:43.563239Z"}