This vulnerability occurs in Guzzle's cookie handling logic, where SetCookie::matchesDomain() incorrectly treats noncanonical IP address representations as hostnames. The bug allows an attacker to register a cookie for a domain such as 0x7f000001, causing the cookie to be sent to any subdomain matching that pattern, like evil.0x7f000001. Consequently, an attacker can disclose session identifiers or tokens to a host that is not the intended IP address and even set state via a forged response. The weakness originates from improper input validation of domain names and inconsistent handling of numeric host representations, corresponding to CWE‑180, CWE‑346, and CWE‑384.

The affected vendor is Guzzle, specifically the Guzzle PHP HTTP client. Versions older than 7.15.2 in the 7.x line and older than 8.0.1 in the 8.x line are vulnerable. No other vendors or products are listed. No further version granularity is provided beyond the major release numbers.

The CVSS score is 6.5, indicating moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, reducing perceived exploitability, though the conceptual attack described requires the application to enable cookie support and to contact a hostname containing the spoofed domain. If those conditions are met, an attacker could exfiltrate session data or hijack a user’s session. The lack of public exploits does not eliminate risk, as the vulnerability is functionally able to be abused under a realistic environment.