The flaw lies in Guzzle’s CookieJar, which does not enforce host‑only scoping for cookies that have an IP‑address or bare‑numeric domain value. SetCookie::matchesDomain() applies ordinary suffix matching, so a cookie defined for a numeric domain such as 192.168.0.1, [::1], or 1 can be matched by another host that uses the same string. An attacker that can control an HTTP server can set a Set‑Cookie header with such a domain value, and any Guzzle client that accepts the cookie will store it for a different host. This enables cross‑host cookie disclosure, cookie injection, or session fixation, constituting CWE‑346 and CWE‑384 weaknesses.

The affected product is the Guzzle PHP HTTP client. All releases prior to 7.12.3 are impacted; version 7.12.3 and later contain the fix.

The CVSS base score of 4.7 indicates a moderate severity. The EPSS score is less than 1%, indicating a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires an adversary to control an HTTP server that sends a Set‑Cookie header with an IP‑address or numeric domain value, and a Guzzle client that uses a CookieJar. If exploited, the attacker can read or inject cookies belonging to other hosts, potentially leading to session fixation or hijacking. Successful exploitation depends on the configuration of the target application and the presence of a Guzzle CookieJar.