AIKIDO-2026-646305

TL;DR

guzzle's built-in cURL handlers pass https:// proxy URLs directly to libcurl, which on versions older than 7.50.2 silently downgrades the proxy connection to plaintext instead of establishing TLS — exposing proxy authentication credentials (Proxy-Authorization headers, userinfo in the proxy URL) and, for plain HTTP requests, full request headers and bodies on the proxy leg; tunneled end-to-end HTTPS traffic is unaffected since its inner TLS session remains intact. Newer libcurl versions (7.50.2+) either reject the unsupported configuration at connect time or handle HTTPS proxies correctly, so only deployments combining an https:// proxy configuration with libcurl 7.50.2 are at risk.