Executive brief
Guzzle is a PHP HTTP client library used to make web requests in applications. Versions before 7.15.1 fail to properly isolate host-only cookies, allowing attackers who control child domains to intercept session tokens and authorization credentials intended only for parent domains. This can lead to account takeover or data exposure when the same cookie jar is reused across different trust boundaries.
Technical details
The vulnerability is a cookie scope handling defect (CWE-201). Guzzle's CookieJar incorrectly stores the request host in the Domain field of host-only cookies instead of preserving their host-only state. Host-only cookies (those set without a Domain attribute) should be sent only to the exact host that set them, but Guzzle treats them as domain cookies applicable to subdomains. Exploitation requires: (1) the application to enable Guzzle's built-in cookie support, (2) reuse of the same cookie jar across parent and child hosts, (3) a host-only cookie received from a parent host, and (4) a subsequent request to a child subdomain. An attacker controlling or observing the child host can thus receive session identifiers or authorization tokens. The issue is patched in version 7.15.1 and later, which records a host-only flag and validates persisted cookie records before loading.
Affected products
- Guzzle Guzzle before 7.15.1
Timeline
- 2026-07-18: disclosed: GitHub Security Advisory GHSA-wm3w-8rrp-j577 published
- 2026-07-18: patched: Version 7.15.1 released with fix
- 2026-08-01: advisory: CVE-2026-67355 published to NVD