Executive brief
Guzzle, a popular PHP library for making web requests, fails to properly restrict certain security cookies to their original website. This flaw allows sensitive information, such as login session tokens, to be accidentally sent to subdomains that should not have access to them. If an attacker controls one of these subdomains, they could steal user sessions or other private data.
Technical details
Guzzle's CookieJar component incorrectly handles cookies set without a Domain attribute or with an empty one. According to RFC 6265, such cookies should be 'host-only' and restricted to the exact originating host; however, Guzzle stores the request host in the Domain field and applies standard domain matching. This allows a cookie set by 'example.com' to be sent to 'child.example.com'. An attacker who can observe or control a subdomain can capture these cookies, leading to the disclosure of session identifiers or authorization tokens. The issue is fixed in version 7.15.1, which introduces a HostOnly marker to track and enforce correct cookie scoping.
Affected products
- GuzzleHTTP guzzle < 7.15.1
Timeline
- 2026-07-18: disclosed: Vulnerability published to guzzle/guzzle repository
- 2026-07-20: advisory: GitHub Advisory GHSA-wm3w-8rrp-j577 published
- 7.15.1: patched
References
- https://api.github.com/users/GrahamCampbell
- https://github.com/GrahamCampbell
- https://api.github.com/users/GrahamCampbell/gists%7B/gist_id%7D
- https://api.github.com/users/GrahamCampbell/repos
- https://avatars.githubusercontent.com/u/2829600?v=4
- https://api.github.com/users/GrahamCampbell/events%7B/privacy%7D