GHSA-94pj-82f3-465w: Guzzle: Proxy-Authorization headers can be sent to origin servers

Impact In affected versions, the built-in cURL handlers (CurlHandler and CurlMultiHandler) put every first-class request header in cURL's origin header list (CURLOPT_HTTPHEADER). These handlers are the default when the PHP cURL extension is available. They move Proxy-Authorization to the proxy-only list (CURLOPT_PROXYHEADER) only when Guzzle predicts an HTTP or HTTPS proxy. A "first-class" header is part of the normal request message and can be set on a PSR-7 request, through client headers defaults, the headers request option, or middleware. It does not include a literal line supplied through raw CURLOPT_HTTPHEADER, CURLOPT_PROXYHEADER, or stream_context.http.header controls. Because that migration follows Guzzle's prediction rather than the route libcurl actually takes, the credential stays in the origin list and is sent to the origin server when a request is: - direct, including proxy set to '' to disable proxying. - bypassed by a no, no_proxy, or NO_PROXY match. - sent through a SOCKS proxy, which does not use the HTTP proxy header channel. - redirected from a safely proxied hop into any of those routes: redirect middleware re-evaluates the proxy per hop but, unlike Authorization and Cookie, does not strip Proxy-Authorization cross-origin. On installations whose libcurl is older than 7.37.0, or whose PHP cURL extension lacks CURLOPT_PROXYHEADER, CURLOPT_HEADEROPT, and CURLHEADER_SEPARATE, no proxy-only channel is available, so cURL left the header in the origin list for every route. The stream handler also serialized first-class values before selecting a proxy. PHP removes only the first Proxy-Authorization line from CONNECT, so another first-class value or a URL-userinfo Basic line could reach the tunneled origin. A later raw stream_context.http.proxy override could instead reroute either credential directly to the origin. The disclosed value is a private credential meant only for the proxy. RFC 9110 defines Proxy-Authorization as credentials for the next