VulnerableCode Package Details - pkg:composer/guzzlehttp/guzzle@4.0.0-rc2

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:composer/guzzlehttp/guzzle@4.0.0-rc2

Essentials
History (1)

purl	pkg:composer/guzzlehttp/guzzle@4.0.0-rc2
Tags	Ghost

Next non-vulnerable version	6.5.8
Latest non-vulnerable version	7.4.5
Risk	10.0

Vulnerabilities affecting this package (1)

Vulnerability	Summary	Fixed by
VCID-zawz-vky5-tkgt Aliases: CVE-2016-5385 GHSA-m6ch-gg5f-wxx3	Improper Access Control PHP does not attempt to address RFC section namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the `HTTP_PROXY` environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an `httpoxy` issue.	4.2.4 Affected by 5 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 5.3.1 Affected by 5 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 6.2.1 Affected by 5 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-zawz-vky5-tkgt
Aliases:
CVE-2016-5385
GHSA-m6ch-gg5f-wxx3

Improper Access Control PHP does not attempt to address RFC section namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the `HTTP_PROXY` environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an `httpoxy` issue.

4.2.4
Affected by 5 other vulnerabilities.

5.3.1
Affected by 5 other vulnerabilities.

6.2.1
Affected by 5 other vulnerabilities.

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T16:00:15.781059+00:00	GHSA Importer	Affected by	VCID-zawz-vky5-tkgt	https://github.com/advisories/GHSA-m6ch-gg5f-wxx3	38.0.0