GuzzleHttp Guzzle versions before 7.14.2 fail to isolate Proxy‑Authorization headers when using cURL handlers. The resulting leak allows attacker-supplied proxy credentials to appear in origin server access logs, exposing them without requiring direct code execution. This weakness is a classic example of Information‑Leakage under CWE‑200.

The affected product is the Guzzle HTTP client library distributed by the guzzlephp project. All released versions prior to 7.14.2 are vulnerable; the issue appears when proxy requests are handled via cURL or when SOCKS proxies are misidentified as direct connections.

The CVSS score of 6.9 classifies it as moderate severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog. The attack does not require privileged access to the Guzzle client itself; rather, an adversary who can observe or control origin‑server logs that record incoming requests can capture the inadvertently logged proxy credentials. The likelihood of exploitation depends primarily on the presence of such logs, but because once a log record exists the credentials can be recovered by anyone with read access, the overall risk is significant for systems that store detailed request logs.