CVE-2026-59883
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the Guzzle PHP HTTP client library prior to version 7.12.3, a vulnerability was found in the CookieJar class. The SetCookie::matchesDomain() method incorrectly handled IP addresses (e.g., 192.168.0.1, [::1]) and bare numeric values as domains by applying ordinary suffix matching, allowing cross-host cookie disclosure, cookie injection, or session fixation.
Risk Assessment
An attacker could exploit this vulnerability to steal or replace session cookies between different hosts on a local network, leading to session hijacking or unauthorized access to applications.
Recommendation
Immediately update the Guzzle library to version 7.12.3 or later, which contains the fix for this issue.
Other vulnerabilities in Guzzle
See all- CVE-2026-69246High
Guzzle, an extensible PHP HTTP client, prior to versions 7.15.2 and 8.0.1, has a vulnerability due to discrepancy between Guzzle's URI parsing and libcurl's. An attacker influencing the request URI can bypass application checks and access hosts that should be blocked. Fixed in versions 7.15.2 and 8.0.1.
- CVE-2026-69245Medium
Guzzle prior to versions 7.15.2 and 8.0.1 contains a vulnerability in the SetCookie::matchesDomain() method that incorrectly recognizes domains in hexadecimal or mixed-base forms (e.g., 0x7f000001) as IP addresses. Cookies set for such domains may be sent to other hosts, leading to disclosure of session identifiers or tokens.
Original NVD description (English source)
Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain values to the exact host that set them, because SetCookie::matchesDomain() applied ordinary suffix matching to domains such as 192.168.0.1, [::1], or 1, allowing cross-host cookie disclosure, cookie injection, or session fixation. This issue is fixed in version 7.12.3.