CVE-2026-55767 Overview
CVE-2026-55767 is an origin validation flaw [CWE-346] in Guzzle, an extensible PHP HTTP client. Versions prior to 7.12.1 accept cookies with a dot-only Domain attribute and whitespace-padded variants. The CookieJar implementation normalizes these values to an empty string, which then matches any request host. An attacker-controlled origin can set a cookie that Guzzle later transmits to unrelated hosts sharing the same jar. This enables cookie injection and session fixation against downstream services, depending on how those services interpret the injected cookie.
Critical Impact
A malicious origin can plant cookies in a shared Guzzle CookieJar that are then sent to arbitrary unrelated hosts, enabling cross-host cookie injection and potential session fixation.
Affected Products
- Guzzle PHP HTTP client versions prior to 7.12.1
- PHP applications using GuzzleHttp\Cookie\CookieJar with a shared jar across multiple request origins
- Downstream services that consume cookies forwarded by vulnerable Guzzle clients
Discovery Timeline
- 2026-06-23 - CVE CVE-2026-55767 published to NVD
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2026-55767
Vulnerability Analysis
The vulnerability resides in Guzzle's cookie handling logic, specifically in two methods of the SetCookie class. SetCookie::matchesDomain() strips leading dots from the cookie's Domain attribute before comparison with the request host. SetCookie::validate() rejects only strictly empty Domain values, allowing strings such as . or whitespace-padded dot variants to pass validation. When normalization removes the leading dot, the domain becomes an empty string, which the matching logic then treats as matching every host.
The vulnerability is classified as Improper Origin Validation [CWE-346]. Exploitation occurs over the network without authentication or user interaction, though impact is limited to integrity of cookie-bearing requests. EPSS data places the probability of exploitation at 0.111%.
Root Cause
The root cause is inconsistent input validation between cookie acceptance and cookie matching. validate() enforces a non-empty raw Domain, but matchesDomain() normalizes the value after acceptance. A dot-only or whitespace-padded Domain attribute survives validation, then collapses to an empty string during matching. The empty normalized domain bypasses the same-origin invariant cookie jars are expected to maintain.
Attack Vector
An attacker who controls a host an application contacts through a shared CookieJar returns a Set-Cookie header with a Domain attribute of . or a whitespace-padded variant such as .. Guzzle stores this cookie. On subsequent requests issued through the same jar to unrelated hosts, the normalized empty domain matches every target host, and Guzzle attaches the attacker-supplied cookie. The downstream service may then accept the cookie for session establishment or state manipulation, enabling session fixation or injection of attacker-controlled values into application logic.
No verified public exploit code is currently available. Technical details are described in the GitHub Security Advisory.
Detection Methods for CVE-2026-55767
Indicators of Compromise
- HTTP responses from upstream origins containing Set-Cookie headers with a Domain attribute equal to ., ., or . or other whitespace-padded dot variants.
- Outbound Guzzle requests carrying cookies to hosts that did not originally issue them.
- Anomalous session identifiers appearing in downstream service logs that match cookies known to originate from unrelated origins.
Detection Strategies
- Inspect application dependency manifests (composer.lock) for guzzlehttp/guzzle versions below 7.12.1.
- Add logging or middleware around GuzzleHttp\Cookie\CookieJar to record cookie Domain attributes received from remote origins.
- Review server-side cookie acceptance logic on downstream services for evidence of unexpected session fixation patterns.
Monitoring Recommendations
- Monitor egress HTTP traffic from PHP application servers for cookies whose Domain attribute is empty or whitespace-only after parsing.
- Alert on Guzzle client traffic where the same cookie value is sent to multiple distinct destination hostnames.
- Track Software Composition Analysis (SCA) findings for guzzlehttp/guzzle across all PHP services until remediation is confirmed.
How to Mitigate CVE-2026-55767
Immediate Actions Required
- Upgrade guzzlehttp/guzzle to version 7.12.1 or later across all PHP projects using Composer.
- Audit application code for shared CookieJar instances used across requests to multiple origins and isolate jars per trust boundary.
- Review downstream services that consume cookies forwarded by Guzzle clients for session fixation exposure.
Patch Information
The maintainers fixed the issue in Guzzle 7.12.1 by tightening domain validation in SetCookie::validate() to reject dot-only and whitespace-padded Domain values before they reach the matching logic. Full patch details are available in the GitHub Security Advisory.
Workarounds
- Use a dedicated CookieJar instance per remote origin rather than sharing a single jar across unrelated hosts.
- Disable the cookie middleware ('cookies' => false) for Guzzle clients that do not require persistent cookies.
- Implement a custom CookieJarInterface that rejects cookies whose normalized Domain is empty before storage.
# Upgrade Guzzle to the patched release using Composer
composer require guzzlehttp/guzzle:^7.12.1
composer update guzzlehttp/guzzle
composer show guzzlehttp/guzzle | grep versions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
