Vulnerability-Lookup

CVE-2026-55767 (GCVE-0-2026-55767)

Vulnerability from cvelistv5 – Published: 2026-06-23 15:05 – Updated: 2026-08-05 21:50

Title

Guzzle: Dot-Only Cookie Domains Match All Hosts in guzzlehttp/guzzle

Summary

Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar incorrectly accepts cookies with a dot-only Domain attribute and whitespace-padded variants. SetCookie::matchesDomain() removes leading dots from the cookie domain, normalizing dot-only values to the empty string; SetCookie::validate() only rejected a strictly empty domain, so these cookies could be stored and the empty normalized domain was treated as matching any request host. An attacker-controlled origin that an application requests with a shared cookie jar can therefore set a cookie that Guzzle later sends to unrelated hosts using the same jar. This may allow cookie injection or session fixation against downstream services, depending on how those services interpret the injected cookie. This vulnerability is fixed in 7.12.1.

Severity

5.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-23 17:47 UTC

CWE

CWE-346 - Origin Validation Error
CWE-1286 - Improper Validation of Syntactic Correctness of Input

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7994 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/guzzle/guzzle/security/advisor…	x_refsource_CONFIRM
https://github.com/guzzle/guzzle/pull/3653	x_refsource_MISC
https://github.com/guzzle/guzzle/commit/7f537cded…	x_refsource_MISC
https://github.com/FriendsOfPHP/security-advisori…	x_refsource_MISC
https://github.com/guzzle/guzzle/releases/tag/7.12.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
guzzle	guzzle	Affected: < 7.12.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55767",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T17:47:47.323538Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T17:47:54.523Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "guzzle",
          "vendor": "guzzle",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.12.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar incorrectly accepts cookies with a dot-only Domain attribute and whitespace-padded variants. SetCookie::matchesDomain() removes leading dots from the cookie domain, normalizing dot-only values to the empty string; SetCookie::validate() only rejected a strictly empty domain, so these cookies could be stored and the empty normalized domain was treated as matching any request host. An attacker-controlled origin that an application requests with a shared cookie jar can therefore set a cookie that Guzzle later sends to unrelated hosts using the same jar. This may allow cookie injection or session fixation against downstream services, depending on how those services interpret the injected cookie. This vulnerability is fixed in 7.12.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1286",
              "description": "CWE-1286: Improper Validation of Syntactic Correctness of Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T21:50:25.575Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/guzzle/guzzle/security/advisories/GHSA-cwxw-98qj-8qjx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/guzzle/guzzle/security/advisories/GHSA-cwxw-98qj-8qjx"
        },
        {
          "name": "https://github.com/guzzle/guzzle/pull/3653",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/guzzle/guzzle/pull/3653"
        },
        {
          "name": "https://github.com/guzzle/guzzle/commit/7f537cded1912349abf5081258d6db19106d774d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/guzzle/guzzle/commit/7f537cded1912349abf5081258d6db19106d774d"
        },
        {
          "name": "https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2026-55767.yaml",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2026-55767.yaml"
        },
        {
          "name": "https://github.com/guzzle/guzzle/releases/tag/7.12.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/guzzle/guzzle/releases/tag/7.12.1"
        }
      ],
      "source": {
        "advisory": "GHSA-cwxw-98qj-8qjx",
        "discovery": "UNKNOWN"
      },
      "title": "Guzzle: Dot-Only Cookie Domains Match All Hosts in guzzlehttp/guzzle"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55767",
    "datePublished": "2026-06-23T15:05:05.552Z",
    "dateReserved": "2026-06-17T14:34:51.881Z",
    "dateUpdated": "2026-08-05T21:50:25.575Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-55767",
      "date": "2026-10-29",
      "epss": "0.00211",
      "percentile": "0.11436"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "guzzle",
                "vendor": "guzzle",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 7.12.1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:guzzlephp:guzzle:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F4DA5939-7C26-4452-A790-9A0457E04DE4",
                    "versionEndExcluding": "7.12.1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar incorrectly accepts cookies with a dot-only Domain attribute and whitespace-padded variants. SetCookie::matchesDomain() removes leading dots from the cookie domain, normalizing dot-only values to the empty string; SetCookie::validate() only rejected a strictly empty domain, so these cookies could be stored and the empty normalized domain was treated as matching any request host. An attacker-controlled origin that an application requests with a shared cookie jar can therefore set a cookie that Guzzle later sends to unrelated hosts using the same jar. This may allow cookie injection or session fixation against downstream services, depending on how those services interpret the injected cookie. This vulnerability is fixed in 7.12.1."
          }
        ],
        "id": "CVE-2026-55767",
        "lastModified": "2026-08-05T22:17:07.543",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-55767",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T17:47:47.323538Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-23T16:17:03.263",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2026-55767.yaml"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/guzzle/guzzle/commit/7f537cded1912349abf5081258d6db19106d774d"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/guzzle/guzzle/pull/3653"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/guzzle/guzzle/releases/tag/7.12.1"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/guzzle/guzzle/security/advisories/GHSA-cwxw-98qj-8qjx"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-346"
              },
              {
                "lang": "en",
                "value": "CWE-1286"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-06-28T07:12:20+00:00",
      "cve": "CVE-2026-55767",
      "id": "CVE-2026-55767",
      "initial_release_date": "2026-06-23T15:05:05.552000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "guzzlehttp/guzzle: Guzzle: Cookie injection and session fixation due to improper domain validation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-55767.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55767",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-23T17:47:47.323538Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-23T17:47:51.294Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "guzzle",
              "vendor": "guzzle",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 7.12.1"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar incorrectly accepts cookies with a dot-only Domain attribute and whitespace-padded variants. SetCookie::matchesDomain() removes leading dots from the cookie domain, normalizing dot-only values to the empty string; SetCookie::validate() only rejected a strictly empty domain, so these cookies could be stored and the empty normalized domain was treated as matching any request host. An attacker-controlled origin that an application requests with a shared cookie jar can therefore set a cookie that Guzzle later sends to unrelated hosts using the same jar. This may allow cookie injection or session fixation against downstream services, depending on how those services interpret the injected cookie. This vulnerability is fixed in 7.12.1."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-346",
                  "description": "CWE-346: Origin Validation Error",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-1286",
                  "description": "CWE-1286: Improper Validation of Syntactic Correctness of Input",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T21:50:25.575Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/guzzle/guzzle/security/advisories/GHSA-cwxw-98qj-8qjx",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/guzzle/guzzle/security/advisories/GHSA-cwxw-98qj-8qjx"
            },
            {
              "name": "https://github.com/guzzle/guzzle/pull/3653",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/guzzle/guzzle/pull/3653"
            },
            {
              "name": "https://github.com/guzzle/guzzle/commit/7f537cded1912349abf5081258d6db19106d774d",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/guzzle/guzzle/commit/7f537cded1912349abf5081258d6db19106d774d"
            },
            {
              "name": "https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2026-55767.yaml",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2026-55767.yaml"
            },
            {
              "name": "https://github.com/guzzle/guzzle/releases/tag/7.12.1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/guzzle/guzzle/releases/tag/7.12.1"
            }
          ],
          "source": {
            "advisory": "GHSA-cwxw-98qj-8qjx",
            "discovery": "UNKNOWN"
          },
          "title": "Guzzle: Dot-Only Cookie Domains Match All Hosts in guzzlehttp/guzzle"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-55767",
        "datePublished": "2026-06-23T15:05:05.552Z",
        "dateReserved": "2026-06-17T14:34:51.881Z",
        "dateUpdated": "2026-08-05T21:50:25.575Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-55767

Vulnerability from fkie_nvd - Published: 2026-06-23 16:17 - Updated: 2026-08-05 22:17

Severity

5.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2026-55767.yaml
security-advisories@github.com	https://github.com/guzzle/guzzle/commit/7f537cded1912349abf5081258d6db19106d774d
security-advisories@github.com	https://github.com/guzzle/guzzle/pull/3653
security-advisories@github.com	https://github.com/guzzle/guzzle/releases/tag/7.12.1
security-advisories@github.com	https://github.com/guzzle/guzzle/security/advisories/GHSA-cwxw-98qj-8qjx	Third Party Advisory

Impacted products

	Vendor	Product	Version
	guzzlephp	guzzle	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "guzzle",
          "vendor": "guzzle",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.12.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:guzzlephp:guzzle:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F4DA5939-7C26-4452-A790-9A0457E04DE4",
              "versionEndExcluding": "7.12.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar incorrectly accepts cookies with a dot-only Domain attribute and whitespace-padded variants. SetCookie::matchesDomain() removes leading dots from the cookie domain, normalizing dot-only values to the empty string; SetCookie::validate() only rejected a strictly empty domain, so these cookies could be stored and the empty normalized domain was treated as matching any request host. An attacker-controlled origin that an application requests with a shared cookie jar can therefore set a cookie that Guzzle later sends to unrelated hosts using the same jar. This may allow cookie injection or session fixation against downstream services, depending on how those services interpret the injected cookie. This vulnerability is fixed in 7.12.1."
    }
  ],
  "id": "CVE-2026-55767",
  "lastModified": "2026-08-05T22:17:07.543",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55767",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-23T17:47:47.323538Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-23T16:17:03.263",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2026-55767.yaml"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/guzzle/guzzle/commit/7f537cded1912349abf5081258d6db19106d774d"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/guzzle/guzzle/pull/3653"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/guzzle/guzzle/releases/tag/7.12.1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/guzzle/guzzle/security/advisories/GHSA-cwxw-98qj-8qjx"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        },
        {
          "lang": "en",
          "value": "CWE-1286"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-CWXW-98QJ-8QJX

Vulnerability from github – Published: 2026-06-19 14:37 – Updated: 2026-08-05 21:49

Summary

guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts

Details

Impact

CookieJar incorrectly accepts cookies with a dot-only Domain attribute, such as Domain=., Domain=.., Domain=..., and whitespace-padded variants such as Domain= .. In affected versions, SetCookie::matchesDomain() removes leading dots from the cookie domain, normalizing dot-only values to the empty string; SetCookie::validate() only rejected a strictly empty domain, so these cookies could be stored and the empty normalized domain was treated as matching any request host.

An attacker-controlled origin that an application requests with a shared cookie jar can therefore set a cookie that Guzzle later sends to unrelated hosts using the same jar. This may allow cookie injection or session fixation against downstream services, depending on how those services interpret the injected cookie. Applications are affected when they use Guzzle's cookie support, for example new Client(['cookies' => true]) or an explicit shared CookieJar, and reuse the same jar across attacker-controlled and trusted origins.

Applications that do not use Guzzle's cookie support, or that use separate cookie jars per origin or trust boundary, are not affected. This issue is distinct from public suffix list validation: dot-only domains contain no domain label and should not match unrelated hosts.

Patches

The issue is patched in 7.12.1 and later. Starting in that release, Guzzle rejects dot-only cookie Domain attributes and prevents an empty normalized cookie domain from matching any request host.

Workarounds

If you cannot upgrade immediately, do not reuse the same CookieJar instance across untrusted and trusted origins. Use separate cookie jars per origin or trust boundary, or disable cookie handling for requests to untrusted hosts.

Avoid using new Client(['cookies' => true]) for clients that may contact unrelated hosts with different trust levels, because that option creates one shared jar for the client.

Severity

5.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "guzzlehttp/guzzle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.12.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55767"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1286",
      "CWE-346"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T14:37:29Z",
    "nvd_published_at": "2026-06-23T16:17:03Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\n`CookieJar` incorrectly accepts cookies with a dot-only `Domain` attribute, such as `Domain=.`, `Domain=..`, `Domain=...`, and whitespace-padded variants such as `Domain= . `. In affected versions, `SetCookie::matchesDomain()` removes leading dots from the cookie domain, normalizing dot-only values to the empty string; `SetCookie::validate()` only rejected a strictly empty domain, so these cookies could be stored and the empty normalized domain was treated as matching any request host.\n\nAn attacker-controlled origin that an application requests with a shared cookie jar can therefore set a cookie that Guzzle later sends to unrelated hosts using the same jar. This may allow cookie injection or session fixation against downstream services, depending on how those services interpret the injected cookie. Applications are affected when they use Guzzle\u0027s cookie support, for example `new Client([\u0027cookies\u0027 =\u003e true])` or an explicit shared `CookieJar`, and reuse the same jar across attacker-controlled and trusted origins.\n\nApplications that do not use Guzzle\u0027s cookie support, or that use separate cookie jars per origin or trust boundary, are not affected. This issue is distinct from public suffix list validation: dot-only domains contain no domain label and should not match unrelated hosts.\n\n### Patches\n\nThe issue is patched in `7.12.1` and later. Starting in that release, Guzzle rejects dot-only cookie `Domain` attributes and prevents an empty normalized cookie domain from matching any request host.\n\n### Workarounds\n\nIf you cannot upgrade immediately, do not reuse the same `CookieJar` instance across untrusted and trusted origins. Use separate cookie jars per origin or trust boundary, or disable cookie handling for requests to untrusted hosts.\n\nAvoid using `new Client([\u0027cookies\u0027 =\u003e true])` for clients that may contact unrelated hosts with different trust levels, because that option creates one shared jar for the client.",
  "id": "GHSA-cwxw-98qj-8qjx",
  "modified": "2026-08-05T21:49:53Z",
  "published": "2026-06-19T14:37:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/guzzle/guzzle/security/advisories/GHSA-cwxw-98qj-8qjx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55767"
    },
    {
      "type": "WEB",
      "url": "https://github.com/guzzle/guzzle/pull/3653"
    },
    {
      "type": "WEB",
      "url": "https://github.com/guzzle/guzzle/commit/7f537cded1912349abf5081258d6db19106d774d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2026-55767.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/guzzle/guzzle"
    },
    {
      "type": "WEB",
      "url": "https://github.com/guzzle/guzzle/releases/tag/7.12.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts"
}

UBUNTU-CVE-2026-55767 (CVE-2026-55767)

Vulnerability from osv_ubuntu – Published: 2026-06-23 16:17 – Updated: 2026-10-17 09:45 – Source website

Details

Severity

5.8 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-55767	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-55767	REPORT
	https://github.com/guzzle/guzzle/security/advisor…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "php-guzzlehttp-guzzle",
            "binary_version": "7.4.5-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "guzzle",
        "purl": "pkg:deb/ubuntu/guzzle@7.4.5-1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.4.5-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "php-guzzlehttp-guzzle",
            "binary_version": "7.9.2-0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "guzzle",
        "purl": "pkg:deb/ubuntu/guzzle@7.9.2-0.1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.9.2-0.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "php-guzzlehttp-guzzle",
            "binary_version": "7.15.3-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "guzzle",
        "purl": "pkg:deb/ubuntu/guzzle@7.15.3-1?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.9.2-0.1build1",
        "7.13.1-1",
        "7.15.1-1",
        "7.15.2-1",
        "7.15.3-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "php-guzzlehttp-guzzle",
            "binary_version": "7.9.2-0.1build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "guzzle",
        "purl": "pkg:deb/ubuntu/guzzle@7.9.2-0.1build1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.9.2-0.1",
        "7.9.2-0.1build1"
      ]
    }
  ],
  "aliases": [],
  "details": "Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar incorrectly accepts cookies with a dot-only Domain attribute and whitespace-padded variants. SetCookie::matchesDomain() removes leading dots from the cookie domain, normalizing dot-only values to the empty string; SetCookie::validate() only rejected a strictly empty domain, so these cookies could be stored and the empty normalized domain was treated as matching any request host. An attacker-controlled origin that an application requests with a shared cookie jar can therefore set a cookie that Guzzle later sends to unrelated hosts using the same jar. This may allow cookie injection or session fixation against downstream services, depending on how those services interpret the injected cookie. This vulnerability is fixed in 7.12.1.",
  "id": "UBUNTU-CVE-2026-55767",
  "modified": "2026-10-17T09:45:55Z",
  "published": "2026-06-23T16:17:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-55767"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55767"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/guzzle/guzzle/security/advisories/GHSA-cwxw-98qj-8qjx"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-55767"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-55767 (GCVE-0-2026-55767)

FKIE_CVE-2026-55767

GHSA-CWXW-98QJ-8QJX

Impact

Patches

Workarounds

UBUNTU-CVE-2026-55767 (CVE-2026-55767)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour