Guzzle’s CookieJar implementation incorrectly applies suffix matching when determining whether a cookie’s domain value is acceptable. For IP‐address or bare numeric domains such as 192.168.0.1, [::1], or 1, the logic treats them like ordinary hostnames, allowing a Set‑Cookie header sent for one numeric domain to be accepted for another host that shares the same string. The result is that an attacker can read other hosts’ cookies, inject new cookies, or perform session fixation by placing malicious cookies into a client that uses a CookieJar. This behavior demonstrates weaknesses summarized by CWE‑346 and CWE‑384.

The Guzzle PHP HTTP client is affected. All releases prior to version 7.12.3 allow the flaw; the bug is fixed in 7.12.3 and later versions. The vendor is guzzle:guzzle.

The CVSS base score of 4.7 indicates moderate severity. The EPSS score is reported as less than 1 %, reflecting a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must control an HTTP server capable of sending a Set‑Cookie header with an IP‑address or numeric domain value, and that the target must be a Guzzle client configured to use a CookieJar. Successful exploitation would enable the attacker to retrieve or inject cookies belonging to other hosts, potentially leading to session fixation or hijacking, but the overall risk remains low due to limited exploitation probability.