CVE-2026-59883: Guzzle PHP HTTP Client Cookie Disclosure

CVE-2026-59883 Overview

CVE-2026-59883 affects Guzzle, an extensible PHP HTTP client widely used in PHP applications for making HTTP requests. Versions prior to 7.12.3 contain a flaw in the CookieJar component that fails to restrict cookies scoped to IP-address or bare-numeric Domain values to the exact host that set them. The SetCookie::matchesDomain() method applies ordinary suffix matching to domain values such as 192.168.0.1, [::1], or 1. This behavior enables cross-host cookie disclosure, cookie injection, and session fixation attacks. The issue is resolved in Guzzle version 7.12.3.

Critical Impact
Attackers can leak or inject cookies across hosts that share numeric or IP-based domain patterns, enabling session fixation and unauthorized data access in PHP applications that use Guzzle to communicate with IP-addressable services.

Affected Products

Guzzle PHP HTTP client versions prior to 7.12.3
PHP applications using Guzzle CookieJar with IP-address hosts
Services that communicate with bare-numeric or IPv6 literal endpoints

Discovery Timeline

2026-07-08 - CVE-2026-59883 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-59883

Vulnerability Analysis

The vulnerability resides in Guzzle's cookie handling logic within SetCookie::matchesDomain(). RFC 6265 requires that cookies with an IP address as their Domain attribute must match only the exact host. Guzzle's implementation applied suffix matching to all domain values, treating IP literals and numeric hosts as if they were regular DNS names. This allowed a cookie set for host 192.168.0.1 to match hosts like 10.192.168.0.1 if such a request occurred, and similarly for IPv6 literals such as [::1] and bare-numeric hostnames such as 1.

This classifies as an Origin Validation Error [CWE-346]. In practice, an attacker who can influence the Set-Cookie header returned to a Guzzle client, or who controls a downstream service the client contacts, may cause cookies to be sent to unintended hosts on subsequent requests handled by the same cookie jar.

Root Cause

The root cause is missing type discrimination in SetCookie::matchesDomain(). The function did not distinguish between DNS names, IPv4 addresses, IPv6 literals, and bare-numeric strings before applying suffix matching semantics. RFC 6265 §5.1.3 mandates exact-match-only behavior for IP-based cookie domains, which Guzzle did not enforce.

Attack Vector

Exploitation requires user interaction and a scenario where a Guzzle-based client communicates with multiple hosts using IP addresses or numeric hostnames while sharing a CookieJar. An attacker controlling one such host can set cookies that are subsequently transmitted to unrelated hosts, enabling session fixation or exfiltration of authentication tokens. Attack complexity is high because the exploit depends on shared cookie jars and IP-based host targets.

php

             return true;
         }
 
+        // IP literals and numeric hosts are exact-match-only per RFC 6265.
+        // Only the exact match above may succeed for those cookie domains.
+        if (self::isIpAddressOrNumericHost($cookieDomain)) {
+            return false;
+        }
+
         // Matching the subdomain according to RFC 6265.
         // https://datatracker.ietf.org/doc/html/rfc6265#section-5.1.3
         if (\filter_var($domain, \FILTER_VALIDATE_IP)) {

Source: Guzzle security patch commit b9944c1. The patch adds an explicit check via isIpAddressOrNumericHost() that forces exact-match semantics for IP literals and numeric hosts, rejecting suffix matches.

Detection Methods for CVE-2026-59883

Indicators of Compromise

Unexpected Cookie headers transmitted to internal IP-addressed services in Guzzle client logs
Cookies persisted in shared CookieJar instances with Domain values matching IP literals or bare numbers
Session tokens appearing on hosts that did not originate them in outbound HTTP traffic

Detection Strategies

Audit dependency manifests (composer.lock) for guzzlehttp/guzzle versions earlier than 7.12.3
Inspect application code for shared CookieJar instances used across requests to IP-addressed endpoints
Review HTTP logs for Set-Cookie headers with Domain attributes containing IP addresses or numeric-only values

Monitoring Recommendations

Enable outbound HTTP traffic logging on services using Guzzle to detect anomalous cookie transmission
Alert on cookie values crossing host boundaries within the same application session
Track composer dependency updates in CI/CD pipelines to identify unpatched Guzzle installations

How to Mitigate CVE-2026-59883

Immediate Actions Required

Upgrade Guzzle to version 7.12.3 or later using composer update guzzlehttp/guzzle
Inventory all PHP applications using Guzzle with shared cookie jars against IP-addressable hosts
Rotate any session tokens that may have been exposed through cross-host cookie transmission

Patch Information

The fix is available in Guzzle 7.12.3, released via the GitHub Release 7.12.3. The patch is implemented in Pull Request #3694 and details are published in the GitHub Security Advisory GHSA-g446-98w2-8p5w. The change treats IP address and numeric host cookie domains as exact-match-only, aligning with RFC 6265 §5.1.3.

Workarounds

Avoid sharing a single CookieJar instance across requests to different IP-addressed hosts
Use per-request cookie jars when communicating with IP-based endpoints
Filter or strip Set-Cookie responses from untrusted upstream services before storing them

bash

# Update Guzzle to the patched version
composer require guzzlehttp/guzzle:^7.12.3
composer update guzzlehttp/guzzle

# Verify installed version
composer show guzzlehttp/guzzle | grep versions