Executive brief
Guzzle is a popular PHP library used by applications to make web requests. A flaw in how it handles cookies allows sensitive session information to be sent to unintended websites if the application uses non-standard IP address formats (like hexadecimal or percent-encoded addresses). This could lead to account takeover or session fixation if an attacker controls a host within the same private or container network.
Technical details
The `SetCookie::matchesDomain()` function fails to recognize noncanonical IP address representations (such as hexadecimal `0x7f000001` or percent-encoded `127.0.0.%31`) as IP literals. Because Guzzle treats these as registered domain names rather than fixed IP addresses, it applies suffix-based subdomain matching rules. An attacker controlling a host that ends in one of these strings (e.g., `evil.0x7f000001`) can receive cookies intended for the IP address or set cookies that the client will replay to the IP address. This bypasses the security boundary intended for IP-based origins. The issue is fixed in versions 7.15.2 and 8.0.1 by enforcing exact matches for domains containing percent signs or hexadecimal/octal parts.
Affected products
- GuzzleHttp guzzle < 7.15.2, 8.0.0
Timeline
- 2026-07-26: disclosed
- 2026-08-03: advisory: GitHub Advisory published
- 2026-08-03: patched
References
- https://api.github.com/users/GrahamCampbell
- https://github.com/GrahamCampbell
- https://api.github.com/users/GrahamCampbell/gists%7B/gist_id%7D
- https://api.github.com/users/GrahamCampbell/repos
- https://avatars.githubusercontent.com/u/2829600?v=4
- https://api.github.com/users/GrahamCampbell/events%7B/privacy%7D