Guzzle CVE-2026-59883

Exploitation requires three concurrent conditions: (1) the target PHP application must use Guzzle's CookieJar - either the default FileCookieJar, ArrayCookieJar, or SessionCookieJar - and must persist cookies across multiple HTTP requests within a session; (2) the application must make requests to at least two distinct hosts identified by numeric domain values - IPv4 literals (e.g., 192.168.0.1), IPv6 literals (e.g., [::1]), or bare numeric labels (e.g., 1) - within the same CookieJar scope; (3) the attacker must control or compromise the first numeric-domain endpoint in order to set the cross-scope cookie. Exploitation is limited by: the requirement for attacker control of a reachable numeric-addressed endpoint; the necessity that the application makes follow-up requests to a second numeric host in the same CookieJar session (UI:R); and the fact that applications communicating exclusively with FQDN-based hosts are entirely unaffected regardless of patch status.

The NVD CVSS 3.1 score of 4.7 (Medium) with vector AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N reflects the constrained exploitation conditions accurately. AC:H is the dominant risk-reducer: the attack requires the vulnerable application to reuse a single CookieJar across HTTP requests to multiple numerically addressed hosts, and the attacker must control or influence one of those hosts to plant the cross-scope cookie. S:C (Changed Scope) correctly captures that the impact extends beyond the system the attacker initially interacts with, affecting downstream hosts that receive injected cookies. EPSS data is not present in the available intelligence, but given the AC:H requirement and the niche deployment pattern needed, opportunistic mass exploitation is unlikely; targeted abuse against microservice architectures or IoT management backends that use Guzzle with IP-addressed endpoints is a more plausible threat model. This CVE is not listed in the CISA KEV catalog and no proof-of-concept has been identified, further supporting a low-to-moderate immediate operational priority for most organizations. The risk is highest for PHP applications that proxy or aggregate requests across multiple internal IP-based endpoints using a shared cookie context.

An attacker operating a service at 10.0.0.2 - which the vulnerable PHP application contacts using Guzzle - responds with a Set-Cookie header scoped to domain '10.0.0.1'. Because matchesDomain() applies suffix matching to this numeric value, Guzzle's CookieJar stores the cookie and subsequently forwards it on requests to the legitimate backend at 10.0.0.1, achieving session fixation or injecting forged authentication state. No public proof-of-concept code has been identified at time of analysis, but the exploit logic is straightforward to construct from the advisory description.