CVE-2026-67355
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
guzzlehttp/guzzle before version 7.15.1 fails to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session identifiers and authorization tokens.
Risk Assessment
An attacker can intercept sensitive session cookies, potentially leading to unauthorized access to user accounts and data.
Recommendation
Update guzzlehttp/guzzle to version 7.15.1 or later.
Other vulnerabilities in guzzlehttp/guzzle
See all- CVE-2026-67354Medium
guzzlehttp/guzzle before version 7.15.1 contains an information disclosure vulnerability in RedirectMiddleware. When the optional allow_redirects.referer setting is enabled, the middleware copies the URI fragment from the referring request into the Referer header during a redirect. An attacker controlling the redirect destination can read this fragment, potentially disclosing one-time login secrets, access tokens, and other sensitive data.
- CVE-2026-67353Medium
guzzlehttp/guzzle before version 7.15.1 contains a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and generate oversized Cookie headers that fail in handlers or destination servers.
Original NVD description (English source)
guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session identifiers and authorization tokens when the same cookie jar is reused across trust boundaries.