CVE-2026-55767 Details
Description
Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar incorrectly accepts cookies with a dot-only Domain attribute and whitespace-padded variants. SetCookie::matchesDomain() removes leading dots from the cookie domain, normalizing dot-only values to the empty string; SetCookie::validate() only rejected a strictly empty domain, so these cookies could be stored and the empty normalized domain was treated as matching any request host. An attacker-controlled origin that an application requests with a shared cookie jar can therefore set a cookie that Guzzle later sends to unrelated hosts using the same jar. This may allow cookie injection or session fixation against downstream services, depending on how those services interpret the injected cookie. This vulnerability is fixed in 7.12.1.
A vulnerability in the Guzzle HTTP client for PHP, affecting versions prior to 7.12.1, allows for improper handling of cookies with dot-only Domain attributes. The CookieJar component accepted these cookies, including variants padded with whitespace. The SetCookie class normalized dot-only domains to an empty string, which was then treated as matching any request host. This flaw could enable an attacker to inject cookies or fixate sessions with downstream services, depending on how those services handle the injected cookies.
Users can upgrade to Guzzle version 7.12.1 or later, where this vulnerability is patched. If an immediate upgrade is not possible, it is recommended to avoid reusing the same CookieJar instance across untrusted and trusted origins, use separate cookie jars per origin or trust boundary, or disable cookie handling for requests to untrusted hosts.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1286 | Improper Validation of Syntactic Correctness of Input | [email protected] |
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| guzzlephp guzzle | < 7.12.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | [email protected] |
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |