EUVD-2026-51845
GHSA-mjrx-74jh-7xgw
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector with high complexity (requires shared jar across trust boundary and attacker-controlled subdomain); no auth needed; confidentiality-only impact; no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session identifiers and authorization tokens when the same cookie jar is reused across trust boundaries.
AnalysisAI
Cookie scope leakage in guzzlehttp/guzzle before 7.15.1 allows an attacker controlling a child subdomain to receive host-only session cookies intended exclusively for the parent host. Guzzle's CookieJar incorrectly stores the originating request host in the cookie's Domain field rather than marking it host-only, causing ordinary domain-matching logic to forward the cookie to subdomains - exposing session identifiers and authorization tokens. No public exploit identified at time of analysis, but the CVSS 4.0 score of 8.2 reflects high confidentiality impact when the specific exploitation conditions are met.
Technical ContextAI
Guzzle is a widely-used PHP HTTP client library (cpe:2.3:a:guzzle:guzzle:*:*:*:*:*:*:*:*). Per RFC 6265, a cookie set without a Domain attribute - or with an empty Domain - is 'host-only' and must be returned solely to the exact originating host. Guzzle's CookieJar violated this by storing the request host string in the Domain field and then applying standard domain suffix-matching rules, effectively promoting a host-only cookie to a domain-scoped cookie. This behavior also propagated through FileCookieJar and SessionCookieJar, meaning persisted and reloaded cookie jars retained the widened scope. CWE-201 (Insertion of Sensitive Information Into Sent Data) captures the root cause: the library transmits sensitive cookie material to a recipient - a child host - that the originating server never authorized to receive it.
RemediationAI
Vendor-released patch: 7.15.1. Upgrade guzzlehttp/guzzle to version 7.15.1 or later via Composer (composer require guzzlehttp/guzzle:^7.15.1). The fix introduces a HostOnly boolean marker in cookie storage and enforces exact-host matching for cookies without a valid Domain attribute; persistent jars (FileCookieJar, SessionCookieJar) now validate this marker on load and reject records missing it. The official advisory is at https://github.com/guzzle/guzzle/security/advisories/GHSA-wm3w-8rrp-j577. For applications that cannot upgrade immediately, use a separate CookieJar instance per host or trust boundary - this eliminates cross-host cookie sharing entirely with no other side effects. Alternatively, avoid enabling Guzzle's built-in cookie support (do not pass a CookieJar to the client) and manage cookies manually if the application does not require subdomain cookie sharing. Note that the workarounds require application-level refactoring and may not be feasible for complex API aggregation layers.
Host confusion in GuzzleHttp Guzzle before 7.15.2 and 8.0.1 allows remote attackers who can influence a fetched URI to b
Cookie domain scope bypass in Guzzle PHP HTTP client (prior to 7.15.2 and 8.0.1) allows improper cookie sharing via non-
URI fragment leakage in guzzlehttp/guzzle's RedirectMiddleware (versions before 7.15.1) exposes sensitive client-side da
Guzzle is a PHP HTTP client. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authenticati
Guzzle, an extensible PHP HTTP client. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low a
Guzzle, an extensible PHP HTTP client. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low a
Guzzle is an open source PHP HTTP client. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no
Guzzle is an open source PHP HTTP client. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no
Denial of service in guzzlehttp/guzzle versions before 7.15.1 allows a malicious or compromised upstream server to exhau
Proxy-Authorization header leakage in guzzlehttp/guzzle before 7.14.2 allows origin servers to receive proxy credentials
Host validation bypass in guzzlehttp/psr7 before 2.12.3 enables URI authority confusion attacks against PHP applications
Cookie domain suffix-matching bypass in Guzzle PHP HTTP client (prior to 7.12.3) allows cross-host cookie disclosure, co
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today