Problem/Motivation

Two security advisories affect the guzzlehttp/guzzle version currently pinned in core's composer.lock:

  • GHSA-v5mv-p594-2x33 / CVE-2026-69246 (high) — Noncanonical host can bypass host-based checks. Affected: >=8.0.0,<8.0.1|<7.15.2. Reported 2026-08-03.
  • GHSA-f7vp-7xgx-4w4r / CVE-2026-69245 (medium) — Noncanonical cookie domain keeps subdomain scope. Same affected ranges.

The affected ranges cover both the Guzzle 8 line used by 12.x and the Guzzle 7 line used by the supported 11.x/10.x branches, so this is not limited to the development branch.

composer audit on the current lock reports both advisories.

Steps to reproduce

  1. Check out the branch and run composer install.
  2. Run composer audit --locked.
  3. Both advisories above are reported against guzzlehttp/guzzle.

Proposed resolution

Update the locked guzzlehttp/guzzle to a fixed release. No constraint change is required: core/composer.json already declares "guzzlehttp/guzzle": "^8.0", which allows the fixed versions.

The fix is available in 8.0.1 and later on the 8.x line, and in 7.15.2 and later on the 7.x line.

Remaining tasks

  • Decide the target version on each branch (8.x line for 12.x, 7.x line for 11.x/10.x).
  • Update composer.lock and the generated metapackage files.
  • Confirm composer audit is clean.
  • Review and commit.

User interface changes

None.

Introduced terminology

None.

API changes

None.

Data model changes

None.

Release notes snippet

Updated guzzlehttp/guzzle to a release that addresses CVE-2026-69246 and CVE-2026-69245.

CommentFileSizeAuthor
#7 3619764-nr-bot_azijp_gh.txt91 bytesneeds-review-queue-bot

Issue fork drupal-3619764

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

andypost created an issue. See original summary.

andypost opened merge request !16896

andypost opened merge request !16897

longwave’s picture

longwave
he/him
Primary language English
Location UK
commented
Status: Active » Needs work

When we do this we normally bump the constraint in composer.json as well, to prevent installing the insecure version, and also update the minimum in the core-recommended meta package as well.

andypost’s picture

andypost
he/him
Primary language Russian
commented
Status: Needs work » Needs review

Looks now ok

andypost’s picture

andypost
he/him
Primary language Russian
commented

btw probably we need separate issue for composer https://getcomposer.org/changelog/2.10.3

needs-review-queue-bot’s picture

needs-review-queue-bot commented
Status: Needs review » Needs work
StatusFileSize
new 3619764-nr-bot_azijp_gh.txt91 bytes

The Needs Review Queue Bot tested this issue. It no longer applies to Drupal core. Therefore, this issue status is now "Needs work".

This does not mean that the patch necessarily needs to be re-rolled or the MR rebased. Read the Issue Summary, the issue tags and the latest discussion here to determine what needs to be done.

Consult the Drupal Contributor Guide to find step-by-step guides for working with issues.