CVE-2026-59883 Details
Description
Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain values to the exact host that set them, because SetCookie::matchesDomain() applied ordinary suffix matching to domains such as 192.168.0.1, [::1], or 1, allowing cross-host cookie disclosure, cookie injection, or session fixation. This issue is fixed in version 7.12.3.
A vulnerability in Guzzle's CookieJar component prior to version 7.12.3 allows cookies scoped to IP addresses or bare-numeric domains to be sent to unintended hosts. This occurs because the SetCookie::matchesDomain() method applies suffix matching to these domains, enabling cross-host cookie disclosure, injection, or session fixation. The issue arises when cookies are stored with a Domain attribute that is an IPv4 literal, a bracketed IPv6 literal, or a bare numeric value, allowing them to be sent to look-alike hosts or bare IP addresses.
Users can upgrade to Guzzle version 7.12.3 or later, where this issue is fixed. If an immediate upgrade is not possible, it is recommended to use separate CookieJar instances for different hosts or trust boundaries, disable cookie handling for untrusted hosts, and avoid scoping cookies to IP addresses or bare numeric domains.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/guzzle/guzzle/commit/b9944c161b12d9ee9c9334cfc5b9659ecd7451f8 | [email protected] | Patch |
| https://github.com/guzzle/guzzle/pull/3694 | [email protected] | Issue TrackingPatch |
| https://github.com/guzzle/guzzle/releases/tag/7.12.3 | [email protected] | Release Notes |
| https://github.com/guzzle/guzzle/security/advisories/GHSA-g446-98w2-8p5w | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
| CWE-384 | Session Fixation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| guzzlephp guzzle | < 7.12.3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | Initial Analysis | [email protected] |
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |