What is the CVSS score of EUVD-2026-42320?

EUVD-2026-42320 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for EUVD-2026-42320?

Yes, a public proof-of-concept exploit is available for EUVD-2026-42320. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for EUVD-2026-42320?

Yes, a patch is available for EUVD-2026-42320. Update the affected software to the latest version immediately.

Guzzle EUVD-2026-42320

| CVE-2026-59883 MEDIUM

Origin Validation Error (CWE-346)

2026-07-08 GitHub_M

GHSA-g446-98w2-8p5w

PHP Code Injection Red Hat Guzzle

6.1

CVSS 3.1 · NVD

Severity by source

Vendor (GitHub_M) PRIMARY

MEDIUM

qualitative

NVD

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

4.7 MEDIUM

Network-reachable via HTTP but AC:H for requiring attacker control of a numeric-domain endpoint and shared CookieJar across hosts; S:C because cookie injection crosses into a different host's security domain.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Red Hat

4.7 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Jul 13, 2026 - 14:07 NVD

4.7 (MEDIUM) 6.1 (MEDIUM)

Patch available

Jul 08, 2026 - 18:02 EUVD

Analysis Generated

Jul 08, 2026 - 17:19 vuln.today

DescriptionNVD

Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain values to the exact host that set them, because SetCookie::matchesDomain() applied ordinary suffix matching to domains such as 192.168.0.1, [::1], or 1, allowing cross-host cookie disclosure, cookie injection, or session fixation. This issue is fixed in version 7.12.3.

AnalysisAI

Cookie domain suffix-matching bypass in Guzzle PHP HTTP client (prior to 7.12.3) allows cross-host cookie disclosure, cookie injection, and session fixation when an application makes requests to multiple IP-address-based or bare-numeric-domain hosts within a shared CookieJar session. The SetCookie::matchesDomain() method incorrectly applied suffix-matching logic - valid for FQDN hierarchies - to numeric domain identifiers such as 192.168.0.1, [::1], and bare labels like 1, meaning a cookie set by one numeric host could be forwarded to a structurally related but distinct host. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 7.12.3.

Technical ContextAI

Guzzle (CPE: cpe:2.3:a:guzzle:guzzle:*:*:*:*:*:*:*:*) is a widely adopted PHP HTTP client library used extensively in Laravel, Symfony, and other PHP ecosystems. The vulnerable component is CookieJar, specifically the SetCookie::matchesDomain() helper that determines whether a stored cookie should be forwarded to a given request host. For regular domain names, suffix matching (e.g., '.example.com' matching 'sub.example.com') is the correct and RFC-defined behavior. However, RFC 6265 explicitly requires that cookies scoped to IP addresses or numeric domain labels be matched only against the exact host that set them - suffix semantics do not apply. The root cause, CWE-346 (Origin Validation Error), manifests here because the library failed to discriminate between FQDN-style and numeric-style domain identifiers before applying matching logic, allowing a cookie from 192.168.0.100 to be considered a match for a request to 192.168.0.1 by virtue of sharing the trailing octet string.

RemediationAI

Upgrade Guzzle to version 7.12.3 or later; this is a vendor-released patch confirmed at https://github.com/guzzle/guzzle/releases/tag/7.12.3. The underlying fix is implemented in commit b9944c161b12d9ee9c9334cfc5b9659ecd7451f8 (https://github.com/guzzle/guzzle/commit/b9944c161b12d9ee9c9334cfc5b9659ecd7451f8) and pull request https://github.com/guzzle/guzzle/pull/3694. For PHP applications using Composer, run 'composer require guzzlehttp/guzzle:^7.12.3'. If immediate upgrade is not feasible, a targeted compensating control is to instantiate a separate CookieJar per request or per target host rather than sharing a single instance across connections to different IP-addressed endpoints; this prevents cross-host cookie forwarding without requiring a library upgrade, though it may alter session-continuity behavior for multi-step flows. Applications that exclusively communicate with fully qualified domain name (FQDN) hosts and never use IP addresses or bare numeric labels as request targets are not affected by this specific code path.