Vulnerability · Published Jun 23, 2026 · Assigned by GitHub_M
CVE-2026-55767Guzzle: Dot-Only Cookie Domains Match All Hosts in guzzlehttp/guzzle
Medium 5.8
In plain English
A medium-severity security flaw in guzzle from guzzle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar incorrectly accepts cookies with a dot-only Domain attribute and whitespace-padded variants. SetCookie::matchesDomain() removes leading dots from the cookie domain, normalizing dot-only values to the empty string; SetCookie::validate() only rejected a strictly empty domain, so these cookies could be stored and the empty normalized domain was treated as matching any request host. An attacker-controlled origin that an application requests with a shared cookie jar can therefore set a cookie that Guzzle later sends to unrelated hosts using the same jar. This may allow cookie injection or session fixation against downstream services, depending on how those services interpret the injected cookie. This vulnerability is fixed in 7.12.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | guzzle | no fix listed | DEBIAN-CVE-2026-55767 |
| Debian:13 | guzzle | no fix listed | DEBIAN-CVE-2026-55767 |
| Debian:14 | guzzle | 7.12.1-1 | DEBIAN-CVE-2026-55767 |
| Packagist | guzzlehttp/guzzle | 7.12.1 | GHSA-cwxw-98qj-8qjx |
| Ubuntu:24.04:LTS | guzzle | no fix listed | UBUNTU-CVE-2026-55767 |
| Ubuntu:25.10 | guzzle | no fix listed | UBUNTU-CVE-2026-55767 |
| Ubuntu:26.04:LTS | guzzle | no fix listed | UBUNTU-CVE-2026-55767 |
| Ubuntu:26.10 | guzzle | no fix listed | UBUNTU-CVE-2026-55767 |
Affected products (as reported)
Weakness: CWE-346, CWE-1286 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
References
- https://github.com/guzzle/guzzle/security/advisories/GHSA-cwxw-98qj-8qjx x_refsource_CONFIRM
- https://github.com/guzzle/guzzle/pull/3653 x_refsource_MISC
- https://github.com/guzzle/guzzle/commit/7f537cded1912349abf5081258d6db19106d774d x_refsource_MISC
- https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2026-55767.yaml x_refsource_MISC
- https://github.com/guzzle/guzzle/releases/tag/7.12.1 x_refsource_MISC