A client-side TLS misconfiguration in the Guzzle PHP HTTP client allows traffic that should be protected by TLS to a proxy to be transmitted in cleartext when the underlying libcurl library is older than 7.50.2; an https:// proxy URL is silently treated as an http:// proxy, preventing the establishment of a TLS session. As a result, proxy authentication credentials sent in the Proxy-Authorization header, userinfo, or CURLOPT_PROXYUSERPWD, as well as the CONNECT request that specifies the target host and port for tunneled HTTPS connections, are exposed over the network. This flaw corresponds to CWE-311, CWE-319, and CWE-636, indicating the loss of encryption for sensitive data and indirect leakage of information.

PHP applications that use the guzzle:guzzle library before version 7.12.1 and employ the built-in cURL handlers with a libcurl older than 7.50.2 to connect to an https:// proxy. Those environments are at risk if the proxy URL is configured for TLS but the underlying libcurl silently downgrades it to unencrypted HTTP.

The CVSS score of 5.9 marks the vulnerabilitySS score is not available; it is also not listed in the CISA KEV catalog. Exploitation requires an attacker to be able to observe or sniff the client‑to‑proxy link, which does not require elevated privileges or code execution. An attacker placed on the network path can capture the unencrypted Proxy-Authorization header and CONNECT request, gaining cleartext credentials and details of the target host, thereby enabling credential-based attacks or traffic snooping, but giving no direct code execution or denial-of-service capability.