Packagist/guzzlehttp/guzzle CVE-2022-31042, CVE-2022-31043: high 7.5, EPSS 1.96%

Failure to strip the Cookie header on change in host or HTTP downgrade

Action: Upgrade guzzlehttp/guzzle to 6.5.7 or later.

composer require guzzlehttp/guzzle:6.5.7

composer require guzzlehttp/guzzle:7.4.4

Affected

Fixed versions

Sources

• osv: GHSA-f2wf-25xc-69c9
• https://github.com/guzzle/guzzle/security/advisories/GHSA-f2wf-25xc-69c9
• https://nvd.nist.gov/vuln/detail/CVE-2022-31042
• https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8
• https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2022-31042.yaml
• https://github.com/guzzle/guzzle
• https://www.debian.org/security/2022/dsa-5246
• https://www.drupal.org/sa-core-2022-011
• https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx

CVE-2022-31042, CVE-2022-31043 · published 2022-06-09T23:47:25Z · modified 2025-12-10T23:40:57.755467Z · JSON