CVE-2026-69245

Guzzle: Noncanonical cookie domain keeps subdomain scope

Published Aug 3, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain() gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain() recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two spellings a transport reads as an address keep subdomain scope. Hexadecimal and mixed-base forms such as 0x7f000001 and 0177.0.0.0x1 go unrecognized while libcurl 8.21.0 reads both as 127.0.0.1. A percent-escaped Domain keeps that scope on both branches because percent-decoding sits above numeric parsing, so 192.168.0.%31 and 127.0.0.1%2e are registered names in the URI grammar rather than address literals, and no numeric rule in any base classifies them, while libcurl decodes the host before resolving and reads them as 192.168.0.1 and 127.0.0.1. A cookie stored for Domain=0x7f000001 is placed in the Cookie header of a request to evil.0x7f000001, disclosing a session identifier or token to a host that is not that address, and a response from evil.0x7f000001 setting Domain=0x7f000001 is accepted into the jar and replayed to the address, so a server answering for the look-alike name can fix a session or set application state. Exploitation requires the application to enable cookie support, address an origin by one of these spellings, and contact a host whose name ends in that spelling. This issue is fixed in versions 7.15.2 and 8.0.1.

Analysis

Technical impact

This vulnerability occurs in Guzzle's cookie handling logic, where SetCookie::matchesDomain() incorrectly treats noncanonical IP address representations as hostnames. The bug allows an attacker to register a cookie for a domain such as 0x7f000001, causing the cookie to be sent to any subdomain matching that pattern, like evil.0x7f000001. Consequently, an attacker can disclose session identifiers or tokens to a host that is not the intended IP address and even set state via a forged response. The weakness originates from improper input validation of domain names and inconsistent handling of numeric host representations, corresponding to CWE‑180, CWE‑346, and CWE‑384.

Affected Systems

The affected vendor is Guzzle, specifically the Guzzle PHP HTTP client. Versions older than 7.15.2 in the 7.x line and older than 8.0.1 in the 8.x line are vulnerable. No other vendors or products are listed. No further version granularity is provided beyond the major release numbers.

Risk and Exploitability

The CVSS score is 6.5, indicating moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, reducing perceived exploitability, though the conceptual attack described requires the application to enable cookie support and to contact a hostname containing the spoofed domain. If those conditions are met, an attacker could exfiltrate session data or hijack a user’s session. The lack of public exploits does not eliminate risk, as the vulnerability is functionally able to be abused under a realistic environment.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

guzzle

affected

Version	Status	Constraints
`< 7.15.2`	affected	—
`>= 8.0.0, < 8.0.1`	affected	—

No data.

Vendor Product Versions

Guzzlephp

Guzzle

Version	Status	Scheme	Platform
`[0,7.15.2)`	affected	semver	—
`[8.0.0,8.0.1)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Guzzle to version 7.15.2 or later, or 8.0.1 or later, to apply the fixed cookie domain validation.
If an upgrade is not immediately feasible, disable cookie support for requests that communicate with untrusted origins or enforce strict canonical domain checks before adding cookies to outgoing requests.
Apply input sanitization to any domain strings used in SetCookie, ensuring they are valid IPv4 addresses or fully‑qualified domain names with no noncanonical numeric representations.

Generated by OpenCVE AI on August 4, 2026 at 09:42 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-f7vp-7xgx-4w4r	Guzzle: Noncanonical cookie domain keeps subdomain scope

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.199% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/guzzle/guzzle/commit/3aeea0406aab88cbbd86531313d7cebf8ae149a4
https://github.com/guzzle/guzzle/commit/744101956d78b7c1384d0cbf379db13e859167bf
https://github.com/guzzle/guzzle/pull/3907
https://github.com/guzzle/guzzle/pull/3908
https://github.com/guzzle/guzzle/releases/tag/7.15.2
https://github.com/guzzle/guzzle/releases/tag/8.0.1
https://github.com/guzzle/guzzle/security/advisories/GHSA-f7vp-7xgx-4w4r

History

Aug 5, 2026 10:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Guzzlephp Guzzlephp guzzle
Vendors & Products		Guzzlephp Guzzlephp guzzle

Aug 4, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 3, 2026 9:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain() gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain() recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two spellings a transport reads as an address keep subdomain scope. Hexadecimal and mixed-base forms such as 0x7f000001 and 0177.0.0.0x1 go unrecognized while libcurl 8.21.0 reads both as 127.0.0.1. A percent-escaped Domain keeps that scope on both branches because percent-decoding sits above numeric parsing, so 192.168.0.%31 and 127.0.0.1%2e are registered names in the URI grammar rather than address literals, and no numeric rule in any base classifies them, while libcurl decodes the host before resolving and reads them as 192.168.0.1 and 127.0.0.1. A cookie stored for Domain=0x7f000001 is placed in the Cookie header of a request to evil.0x7f000001, disclosing a session identifier or token to a host that is not that address, and a response from evil.0x7f000001 setting Domain=0x7f000001 is accepted into the jar and replayed to the address, so a server answering for the look-alike name can fix a session or set application state. Exploitation requires the application to enable cookie support, address an origin by one of these spellings, and contact a host whose name ends in that spelling. This issue is fixed in versions 7.15.2 and 8.0.1.
Title		Guzzle: Noncanonical cookie domain keeps subdomain scope
Weaknesses		CWE-180 CWE-346 CWE-384
References		https://github.com/guzzle/guzzle/commit/3aeea0406aab88cbbd86531313d7cebf8ae149a4 https://github.com/guzzle/guzzle/commit/744101956d78b7c1384d0cbf379db13e859167bf https://github.com/guzzle/guzzle/pull/3907 https://github.com/guzzle/guzzle/pull/3908 https://github.com/guzzle/guzzle/releases/tag/7.15.2 https://github.com/guzzle/guzzle/releases/tag/8.0.1 https://github.com/guzzle/guzzle/security/advisories/GHSA-f7vp-7xgx-4w4r
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}`