# Guzzle GuzzleHTTP host-only cookie scope disclosure

Source: https://junglewise.ai/threats/guzzle-guzzlehttp-host-only-cookie-scope-disclosure-958db8d5  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-01. Updated: 2026-08-04  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 5.9 · Published 2026-08-01

Guzzle, a popular PHP HTTP client library, contains a flaw in how it handles web cookies. When a website sets a 'host-only' cookie intended only for its specific domain, Guzzle incorrectly allows that cookie to be sent to subdomains as well. This could allow an attacker who controls a subdomain to steal sensitive information like session IDs or login tokens from the main site, potentially leading to unauthorized account access.

Technologies: [Guzzle](https://junglewise.ai/threats/technologies/guzzle), [guzzlehttp/guzzle (Packagist)](https://junglewise.ai/threats/technologies/guzzlehttp-guzzle). Vendors: [Guzzle](https://junglewise.ai/threats/vendors/guzzle), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 5.9, published 1 August 2026.

**Which products and versions are affected?** Guzzle < 7.15.1; guzzlehttp/guzzle (Packagist) < 7.15.1.

**Is there a fix for This vulnerability?** A patch was published on 2026-08-04: Fix confirmed in version 7.15.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Guzzle or guzzlehttp/guzzle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Guzzle versions before 7.15.1 fail to correctly implement host-only cookie semantics in the CookieJar component. When a response cookie is received without a Domain attribute (or an empty one), it should be restricted to the exact originating host. Instead, Guzzle stores the request host in the cookie's Domain field and applies standard domain-matching rules, causing the cookie to be sent to subdomains. An attacker controlling a child host can capture these cookies if the same cookie jar is reused across trust boundaries. The issue is resolved in version 7.15.1, which introduces a HostOnly marker for stored cookies.

## Affected products

- guzzlehttp guzzle < 7.15.1

## Timeline

- 2026-07-18: advisory: Original advisory GHSA-wm3w-8rrp-j577 published
- 2026-08-01: disclosed: CVE-2026-67355 published
- 2026-08-04: patched: Fix confirmed in version 7.15.1

## References

- [https://github.com/guzzle/guzzle/security/advisories/GHSA-wm3w-8rrp-j577](https://github.com/guzzle/guzzle/security/advisories/GHSA-wm3w-8rrp-j577)
- [https://www.vulncheck.com/advisories/guzzlehttp-guzzle-before-host-only-cookie-scope](https://www.vulncheck.com/advisories/guzzlehttp-guzzle-before-host-only-cookie-scope)

## Related threats

- [Guzzle noncanonical host bypass in URI handlers](https://junglewise.ai/threats/cve-2026-69246-guzzle-noncanonical-host-bypass-in-uri-handlers)
- [Guzzle incorrect cookie domain matching for noncanonical IP addresses](https://junglewise.ai/threats/cve-2026-69245-guzzle-incorrect-cookie-domain-matching-for-noncanonical-ip)
- [Guzzle information disclosure in RedirectMiddleware Referer headers](https://junglewise.ai/threats/guzzle-information-disclosure-in-redirectmiddleware-referer-headers-d2e711b6)
- [Guzzle unbounded response cookies denial of service in CookieJar](https://junglewise.ai/threats/guzzle-unbounded-response-cookies-denial-of-service-in-cookiejar-f650c2bc)
- [Guzzle Proxy-Authorization header disclosure to origin servers](https://junglewise.ai/threats/guzzle-proxy-authorization-header-disclosure-to-origin-servers-7a8a6575)