PT-2026-67328 · Composer · Guzzle
CVSS v4.0
8.2
High
| Vector | AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
guzzlehttp/guzzle versions prior to 7.15.1
Description
The
CookieJar component fails to preserve the host-only scope of response cookies that are set without a Domain attribute or with an empty one. Instead of marking these cookies as host-only, the software stores the request host in the Domain field. This behavior allows cookies intended exclusively for a parent host to be sent to child hosts if the same cookie jar is reused across different trust boundaries. An attacker controlling a child host could potentially intercept sensitive information, such as session identifiers and authorization tokens. This issue affects FileCookieJar and SessionCookieJar as well, as they persist the request host without recording the host-only state. The vulnerability is triggered when an application enables cookie support, reuses a built-in cookie jar, and makes requests to both a trusted parent host and a less-trusted child host.Recommendations
Update guzzlehttp/guzzle to version 7.15.1 or later.
As a temporary workaround, avoid reusing a single
CookieJar instance across parent and child hosts with different trust levels.
Use a separate cookie jar for each host or trust boundary.
Disable cookie handling for requests made to less-trusted hosts.
Avoid using new Client(['cookies' => true]) for clients that contact both trusted parent hosts and less-trusted subdomains.
Delete or rotate existing FileCookieJar and SessionCookieJar data that was written by versions prior to 7.15.1.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Guzzle