CVE-2026-55767: Guzzle CookieJar improper domain validation allows cookie injection

CVE-2026-55767 · Severity: medium · CVSS 5.8 · Published 2026-06-23

Guzzle is a popular tool used by PHP applications to communicate with other web services. A security flaw in how it handles 'cookies' (small pieces of data used for sessions) allows a malicious website to set a cookie that Guzzle will mistakenly send to other, unrelated websites. This could allow an attacker to perform session fixation or inject unauthorized data into requests sent to trusted services, potentially compromising user accounts or application logic.

Technologies: Guzzle, guzzlehttp/guzzle (Packagist). Vendors: Guzzle, Packagist.

Quick answers

Is CVE-2026-55767 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55767 being exploited in the wild.
How severe is CVE-2026-55767?
Medium severity, with a CVSS score of 5.8, published 23 June 2026.
Which products and versions are affected?
Guzzle < 7.12.1; guzzlehttp/guzzle (Packagist) < 7.12.1, ECOSYSTEM:introduced=0,fixed=7.12.1.
Is there a fix for CVE-2026-55767?
Yes. guzzlehttp/guzzle (Packagist): upgrade to 7.12.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55767 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55767?
Check whether you run Guzzle or guzzlehttp/guzzle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • guzzlehttp/guzzle (Packagist): upgrade to 7.12.1 or later
    composer require guzzlehttp/guzzle:^7.12.1

Technical details

A vulnerability exists in Guzzle's CookieJar where SetCookie::matchesDomain() incorrectly normalizes dot-only Domain attributes (e.g., 'Domain=.') to an empty string. Because SetCookie::validate() only rejected strictly empty domains, these normalized empty strings were treated as matching any request host. An attacker-controlled server can provide such a cookie, which Guzzle will then include in subsequent requests to unrelated domains if the same CookieJar instance is reused. This enables cookie injection and session fixation attacks. The issue is resolved in version 7.12.1 by rejecting dot-only domains and ensuring empty normalized domains do not match all hosts.

Affected products

  • guzzlehttp guzzle < 7.12.1

Identifiers

  • CVE-2026-55767
  • GHSA-cwxw-98qj-8qjx

Timeline

  • 2026-06-18: advisory: GitHub Advisory GHSA-cwxw-98qj-8qjx published
  • 2026-06-23: disclosed: CVE-2026-55767 published to NVD
  • 2026-06-23: patched: Fixed in version 7.12.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.