{"cve":"CVE-2022-31091","nvd":{"published":"2022-06-27T22:15:08.933","modified":"2026-06-17T04:44:46.673","status":"Modified","description":"Guzzle, an extensible PHP HTTP client. `Authorization` and `Cookie` headers on requests are sensitive information. In affected versions on making a request which responds with a redirect to a URI with a different port, if we choose to follow it, we should remove the `Authorization` and `Cookie` headers from the request, before containing. Previously, we would only consider a change in host or scheme. Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5. Note that a partial fix was implemented in Guzzle 7.4.2, where a change in host would trigger removal of the curl-added Authorization header, however this earlier fix did not cover change in scheme or change in port. An alternative approach would be to use your own redirect middleware, rather than ours, if you are unable to upgrade. If you do not require or expect redirects to be followed, one should simply disable redirects all together.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","score":7.7},"cwes":["CWE-200"],"references":["https://github.com/guzzle/guzzle/commit/1dd98b0564cb3f6bd16ce683cb755f94c10fbd82","https://github.com/guzzle/guzzle/security/advisories/GHSA-q559-8m2m-g699","https://security.gentoo.org/glsa/202305-24","https://www.debian.org/security/2022/dsa-5246","https://github.com/guzzle/guzzle/commit/1dd98b0564cb3f6bd16ce683cb755f94c10fbd82"],"products":["debian:debian_linux","guzzlephp:guzzle"],"source":"nvd","synced_at":"2026-10-19T21:32:39.174919249+00:00"},"epss":{"cve":"CVE-2022-31091","score":0.01565,"percentile":0.75303,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-q559-8m2m-g699","url":"https://osv.dev/vulnerability/GHSA-q559-8m2m-g699","summary":"Change in port should be considered a change in origin","modified":"2023-11-08T04:09:25.594961Z","packages":[{"ecosystem":"Packagist","name":"guzzlehttp/guzzle","purl":"pkg:composer/guzzlehttp/guzzle","ranges":["<6.5.8"],"fixed":["6.5.8"]},{"ecosystem":"Packagist","name":"guzzlehttp/guzzle","purl":"pkg:composer/guzzlehttp/guzzle","ranges":[">=7.0.0 <7.4.5"],"fixed":["7.4.5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}