PT-2026-67522 · Guzzle · Guzzle
CVE-2026-69245
·
Published
2026-08-03
·
Updated
2026-08-03
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Guzzle versions prior to 7.15.2
Guzzle versions prior to 8.0.1
Description
The
SetCookie::matchesDomain() function incorrectly assigns cookies to subdomains when the Domain is specified using hexadecimal, mixed-base, or percent-escaped formats. This occurs because the function fails to recognize these formats as IP literals or numeric hosts, treating them as registered names instead. For example, spellings like 0x7f000001, 0177.0.0.0x1, 192.168.0.%31, and 127.0.0.1%2e are not correctly identified as addresses, while the underlying transport (such as libcurl) resolves them as 127.0.0.1 or 192.168.0.1.This behavior allows a cookie stored for a domain like
Domain=0x7f000001 to be sent in the Cookie header of a request to a malicious host such as evil.0x7f000001, potentially disclosing session identifiers or tokens. Additionally, a response from a malicious host setting Domain=0x7f000001 could be accepted and later replayed to the actual address, allowing an attacker to fix a session or manipulate application state. Exploitation requires cookie support to be enabled and the application to contact a host whose name ends in one of these specific spellings, typically within private, split-horizon, or container zones.Recommendations
Update Guzzle to version 7.15.2 or later.
Update Guzzle to version 8.0.1 or later.
As a temporary workaround, avoid sharing a single
CookieJar between an origin addressed by a numeric or percent-escaped spelling and any other host ending in that spelling.
Use a separate CookieJar for each host or trust boundary.
Address origins using their canonical dotted-decimal form (e.g., 127.0.0.1) instead of hexadecimal or percent-escaped formats.
Reject request URI hosts containing percent escapes or non-ASCII bytes before passing the URI to the client.Fix
Session Fixation
Origin Validation Error
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Guzzle