Is CVE-2026-67355 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67355 being exploited in the wild.

How severe is CVE-2026-67355?

Medium severity, with a CVSS score of 5.9, published 1 August 2026.

Which products and versions are affected?

Guzzle before 7.15.1; guzzlehttp/guzzle (Packagist) ECOSYSTEM:introduced=0,fixed=7.15.1.

Is there a fix for CVE-2026-67355?

Yes. guzzlehttp/guzzle (Packagist): upgrade to 7.15.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67355 attacked?

It is attacked over the network.

Am I affected by CVE-2026-67355?

Check whether you run Guzzle or guzzlehttp/guzzle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67355: Guzzle host-only cookie scope not preserved

CVE-2026-67355 · Severity: medium · CVSS 5.9 · Published 2026-08-01

Guzzle is a PHP HTTP client library used to make web requests in applications. Versions before 7.15.1 fail to properly isolate host-only cookies, allowing attackers who control child domains to intercept session tokens and authorization credentials intended only for parent domains. This can lead to account takeover or data exposure when the same cookie jar is reused across different trust boundaries.

Technologies: Guzzle, guzzlehttp/guzzle (Packagist). Vendors: Guzzle, Packagist.

Quick answers

Is CVE-2026-67355 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67355 being exploited in the wild.
How severe is CVE-2026-67355?: Medium severity, with a CVSS score of 5.9, published 1 August 2026.
Which products and versions are affected?: Guzzle before 7.15.1; guzzlehttp/guzzle (Packagist) ECOSYSTEM:introduced=0,fixed=7.15.1.
Is there a fix for CVE-2026-67355?: Yes. guzzlehttp/guzzle (Packagist): upgrade to 7.15.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67355 attacked?: It is attacked over the network.
Am I affected by CVE-2026-67355?: Check whether you run Guzzle or guzzlehttp/guzzle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

guzzlehttp/guzzle (Packagist): upgrade to 7.15.1 or later
```
composer require guzzlehttp/guzzle:^7.15.1
```

Technical details

The vulnerability is a cookie scope handling defect (CWE-201). Guzzle's CookieJar incorrectly stores the request host in the Domain field of host-only cookies instead of preserving their host-only state. Host-only cookies (those set without a Domain attribute) should be sent only to the exact host that set them, but Guzzle treats them as domain cookies applicable to subdomains. Exploitation requires: (1) the application to enable Guzzle's built-in cookie support, (2) reuse of the same cookie jar across parent and child hosts, (3) a host-only cookie received from a parent host, and (4) a subsequent request to a child subdomain. An attacker controlling or observing the child host can thus receive session identifiers or authorization tokens. The issue is patched in version 7.15.1 and later, which records a host-only flag and validates persisted cookie records before loading.

Affected products

Guzzle Guzzle before 7.15.1

Identifiers

CVE-2026-67355
GHSA-wm3w-8rrp-j577

Timeline

2026-07-18: disclosed: GitHub Security Advisory GHSA-wm3w-8rrp-j577 published
2026-07-18: patched: Version 7.15.1 released with fix
2026-08-01: advisory: CVE-2026-67355 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.