These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-69246 is a vulnerability in Guzzle, an extensible PHP HTTP client. The issue arises from how Guzzle handles request URIs and Host headers, allowing an attacker to influence the fetched URI and reach a host the application's checks excluded, potentially reading sensitive response data. This vulnerability is fixed in Guzzle versions 7.15.2 and 8.0.1.
A vulnerability in Guzzle, an extensible PHP HTTP client, allows sensitive information disclosure due to improper handling of cookie domains. The issue arises from the SetCookie::matchesDomain() method, which incorrectly matches subdomains for certain domain spellings, potentially leading to session identifier or token disclosure to unintended hosts.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T13:17:06.283Z and has not been modified since then. The vulnerability affects guzzlehttp/guzzle versions before 7.15.1, which fail to preserve host-only cookie scope. This can potentially disclose session identifiers and authorization tokens when the same cookie jar is reused across trust boundar [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T13:17:06.143Z and has not been modified since then. The vulnerability is related to the RedirectMiddleware and the optional allow_redirects.referer setting in Guzzle versions before 7.15.1. This setting, when enabled, can lead to the disclosure of sensitive client data. Defenders and developers s [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T13:17:06.000Z and has not been modified since then. The vulnerability affects guzzlehttp/guzzle versions before 7.15.1, which contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. This could allow attackers to return [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T13:17:04.990Z and has not been modified since then. Guzzle HTTP client library versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. This vulnerability potentially exposes proxy credentials through origin server access logs when requests [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-08T17:17:26.737Z and has not been modified since then. Guzzle PHP HTTP client versions prior to 7.12.3 contain a vulnerability in CookieJar that allows cross-host cookie disclosure, cookie injection, or session fixation due to improper domain matching. The issue is fixed in version 7.12.3. Affected [truncated]
CVE-2026-59882 is a vulnerability in Guzzle PSR-7, a PSR-7 HTTP message library implementation in PHP. Prior to version 2.12.3, the Uri::assertValidHost() function does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets. This allows Uri::getHost() to disagree with the URI authority used for security or routing decisions. The issue is fixed in version [truncated]
A security vulnerability has been discovered in Guzzle Services, a library used to describe web services, serialize requests, and parse responses. The vulnerability, tracked as CVE-2026-53723, affects versions prior to 1.5.4 and allows for XML injection attacks. An attacker can exploit this vulnerability by injecting malicious XML elements into the request body, potentially altering operation semantics, s [truncated]
CVE-2026-49214 is a vulnerability in the Guzzle PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 did not reject ASCII control characters, whitespace, or DEL in first-party URI host components. This vulnerability can cause the serialized request to contain additional attacker-controlled header lines, potentially leading to request smuggling or cache poisoning.