{"action":"Upgrade guzzlehttp/guzzle to 6.5.7 or later.","affected":[{"fixed":"6.5.7","introduced":"4.0.0"},{"fixed":"7.4.4","introduced":"7.0.0"}],"component":"guzzlehttp/guzzle","cve_ids":["CVE-2022-31042","CVE-2022-31043"],"ecosystem":"Packagist","epss":0.01961,"exploited":false,"fixed_versions":["6.5.7","7.4.4"],"ghsa_id":"GHSA-f2wf-25xc-69c9","id":"tcs_01M5KF1BY3VXM85N8BFBVE0SWG","modified_at":"2025-12-10T23:40:57.755467Z","published_at":"2022-06-09T23:47:25Z","references":["https://osv.dev/vulnerability/GHSA-f2wf-25xc-69c9","https://github.com/guzzle/guzzle/security/advisories/GHSA-f2wf-25xc-69c9","https://nvd.nist.gov/vuln/detail/CVE-2022-31042","https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8","https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2022-31042.yaml","https://github.com/guzzle/guzzle","https://www.debian.org/security/2022/dsa-5246","https://www.drupal.org/sa-core-2022-011","https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-f2wf-25xc-69c9","url":"https://osv.dev/vulnerability/GHSA-f2wf-25xc-69c9"}],"summary":"Failure to strip the Cookie header on change in host or HTTP downgrade"}