# CVE-2026-67355: Guzzle host-only cookie scope not preserved

Source: https://junglewise.ai/threats/cve-2026-67355-guzzle-host-only-cookie-scope-not-preserved  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-67355 · Severity: medium · CVSS 5.9 · Published 2026-08-01

Guzzle is a PHP HTTP client library used to make web requests in applications. Versions before 7.15.1 fail to properly isolate host-only cookies, allowing attackers who control child domains to intercept session tokens and authorization credentials intended only for parent domains. This can lead to account takeover or data exposure when the same cookie jar is reused across different trust boundaries.

Technologies: [Guzzle](https://junglewise.ai/threats/technologies/guzzle), [guzzlehttp/guzzle (Packagist)](https://junglewise.ai/threats/technologies/guzzlehttp-guzzle). Vendors: [Guzzle](https://junglewise.ai/threats/vendors/guzzle), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-67355 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67355 being exploited in the wild.

**How severe is CVE-2026-67355?** Medium severity, with a CVSS score of 5.9, published 1 August 2026.

**Which products and versions are affected?** Guzzle before 7.15.1; guzzlehttp/guzzle (Packagist) ECOSYSTEM:introduced=0,fixed=7.15.1.

**Is there a fix for CVE-2026-67355?** Yes. guzzlehttp/guzzle (Packagist): upgrade to 7.15.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67355 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-67355?** Check whether you run Guzzle or guzzlehttp/guzzle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- guzzlehttp/guzzle (Packagist): upgrade to 7.15.1 or later

  ```sh
  composer require guzzlehttp/guzzle:^7.15.1
  ```


## Technical details

The vulnerability is a cookie scope handling defect (CWE-201). Guzzle's CookieJar incorrectly stores the request host in the Domain field of host-only cookies instead of preserving their host-only state. Host-only cookies (those set without a Domain attribute) should be sent only to the exact host that set them, but Guzzle treats them as domain cookies applicable to subdomains. Exploitation requires: (1) the application to enable Guzzle's built-in cookie support, (2) reuse of the same cookie jar across parent and child hosts, (3) a host-only cookie received from a parent host, and (4) a subsequent request to a child subdomain. An attacker controlling or observing the child host can thus receive session identifiers or authorization tokens. The issue is patched in version 7.15.1 and later, which records a host-only flag and validates persisted cookie records before loading.

## Affected products

- Guzzle Guzzle before 7.15.1

## Identifiers

- CVE-2026-67355
- GHSA-wm3w-8rrp-j577

## Timeline

- 2026-07-18: disclosed: GitHub Security Advisory GHSA-wm3w-8rrp-j577 published
- 2026-07-18: patched: Version 7.15.1 released with fix
- 2026-08-01: advisory: CVE-2026-67355 published to NVD

## References

- [https://github.com/guzzle/guzzle/security/advisories/GHSA-wm3w-8rrp-j577](https://github.com/guzzle/guzzle/security/advisories/GHSA-wm3w-8rrp-j577)
- [https://www.vulncheck.com/advisories/guzzlehttp-guzzle-before-host-only-cookie-scope](https://www.vulncheck.com/advisories/guzzlehttp-guzzle-before-host-only-cookie-scope)

## Related threats

- [Guzzle noncanonical host bypass in URI handlers](https://junglewise.ai/threats/cve-2026-69246-guzzle-noncanonical-host-bypass-in-uri-handlers)
- [Guzzle incorrect cookie domain matching for noncanonical IP addresses](https://junglewise.ai/threats/cve-2026-69245-guzzle-incorrect-cookie-domain-matching-for-noncanonical-ip)
- [Guzzle GuzzleHTTP host-only cookie scope disclosure](https://junglewise.ai/threats/guzzle-guzzlehttp-host-only-cookie-scope-disclosure-958db8d5)
- [Guzzle information disclosure in RedirectMiddleware Referer headers](https://junglewise.ai/threats/guzzle-information-disclosure-in-redirectmiddleware-referer-headers-d2e711b6)
- [Guzzle unbounded response cookies denial of service in CookieJar](https://junglewise.ai/threats/guzzle-unbounded-response-cookies-denial-of-service-in-cookiejar-f650c2bc)