Guzzle, a widely used PHP HTTP client, implemented a vulnerability in which a noncanonical host component in a request URI could be decoded differently by the underlying transport layer than by the PHP code’s validation. In particular, a URI such as 127.0.0.%31 is rejected by PHP’s filter_var() as an invalid IP literal, but libcurl decodes the percent‐encoded %31 to a decimal 1, resolving the host to 127.0.0.1. The application’s Host header remains 127.0.0.%31, allowing the attacker to reach a loopback address that the application’s own host checks would normally exclude, and read any response from that internal server. Because the transport is driven by the parsed host, the client’s decision logic (proxy selection, no_proxy handling, and redirect middleware that strips authentication headers) is also based on the decoded host, further expanding the attack surface.

The affected software is the Guzzle PHP HTTP client. Versions prior to 7.15.2 for the 7.x branch and prior to 8.0.1 for the 8.x branch are vulnerable. The fix is implemented in Guzzle 7.15.2 and 8.0.1 and later.

The CVSS base score is 7.2, indicating a high severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV. Exploitation requires the application to build a request URI from untrusted input and to rely on Guzzle’s host decision before the request is sent. Attackers who can supply such input can redirect traffic to internal hosts, potentially exposing sensitive data or enabling further compromise.