Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. Th…

CVE-2026-69246 affects Guzzle, a popular extensible PHP HTTP client, in versions prior to 7.15.2 and 8.0.1. The vulnerability stems from a divergence between how Guzzle validates request URIs and how the underlying transport (libcurl or StreamHandler) processes them. Specifically, percent-encoded hosts like 127.0.0.%31 are rejected by PHP's filter_var() but decoded by libcurl to 127.0.0.1, enabling SSRF attacks that bypass host-based access controls. This also affects proxy routing logic (no_proxy) and credential stripping in RedirectMiddleware, since both operate on the unresolved literal host string. An attacker who can influence the URI passed to Guzzle can reach internal or restricted hosts that application-level checks were intended to block. Exploitation requires the application to construct request URIs from untrusted input. The issue is fixed in Guzzle versions 7.15.2 and 8.0.1.