CVE-2026-67355 Overview
CVE-2026-67355 affects guzzlehttp/guzzle versions before 7.15.1. The library fails to preserve host-only cookie scope by storing the request host in the Domain field rather than marking cookies as host-only. Attackers who control child hosts can receive cookies intended only for parent hosts when the same cookie jar is reused across trust boundaries. This information disclosure flaw can expose session identifiers and authorization tokens to unintended hosts. The vulnerability is classified under [CWE-201] (Insertion of Sensitive Information Into Sent Data).
Critical Impact
Reused cookie jars can leak session tokens and authorization credentials from parent hosts to attacker-controlled child hosts, enabling session hijacking and unauthorized API access.
Affected Products
- guzzlehttp/guzzle versions prior to 7.15.1
- PHP applications using Guzzle's CookieJar across multiple hosts
- Downstream libraries and frameworks bundling vulnerable Guzzle versions
Discovery Timeline
- 2026-08-01 - CVE-2026-67355 published to the National Vulnerability Database
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-67355
Vulnerability Analysis
The vulnerability lives in Guzzle's cookie handling logic. When a server returns a Set-Cookie header without an explicit Domain attribute, RFC 6265 requires the client to treat the cookie as host-only and send it only back to the exact origin host. Guzzle instead records the request host inside the cookie's Domain field. This transformation changes the matching semantics from strict host equality to domain-suffix matching.
An application that reuses one CookieJar for requests to example.com and attacker.example.com will send cookies originally scoped to example.com to the attacker-controlled subdomain. Session cookies, CSRF tokens, and bearer tokens carried in Cookie headers can be exposed as a result.
Root Cause
The root cause is missing enforcement of the host-only flag defined by RFC 6265 Section 5.3. Guzzle's cookie store lacks a boolean host-only marker and relies solely on the Domain string for matching. Storing the request host in Domain widens the cookie's scope to any subdomain that ends in that host string.
Attack Vector
Exploitation requires an attacker to control a host inside the same DNS hierarchy as a trusted target, and requires the victim application to reuse the same cookie jar across those hosts. The attacker triggers or waits for the vulnerable client to send a request to the attacker-controlled host after receiving cookies from the trusted host. The attacker then harvests session identifiers or authorization tokens from the inbound Cookie header.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-wm3w-8rrp-j577 for the maintainer's technical write-up.
Detection Methods for CVE-2026-67355
Indicators of Compromise
- Outbound HTTP requests from PHP application servers carrying session cookies to unexpected subdomains or sibling hosts.
- Cookie headers containing authorization tokens sent to hosts that did not originally issue them.
- Application logs showing shared CookieJar instances handling requests across multiple distinct hostnames.
Detection Strategies
- Inventory PHP dependencies with composer show guzzlehttp/guzzle and flag any version below 7.15.1.
- Static analysis of source code for GuzzleHttp\Cookie\CookieJar instances shared between HTTP clients targeting different hosts.
- Network monitoring for anomalous cookie propagation patterns between parent and child domains in egress traffic.
Monitoring Recommendations
- Ingest web proxy and egress traffic logs to detect session cookies traversing DNS boundaries not authorized by the application design.
- Track composer.lock changes across CI/CD pipelines to confirm rollout of patched Guzzle versions.
- Alert on unusual authentication events that follow outbound HTTP requests to newly observed subdomains.
How to Mitigate CVE-2026-67355
Immediate Actions Required
- Upgrade guzzlehttp/guzzle to version 7.15.1 or later across all PHP projects and container images.
- Audit application code for shared CookieJar usage and split jars per trust boundary until patched.
- Rotate session identifiers and API tokens that may have been exposed to untrusted hosts.
Patch Information
The maintainers fixed the flaw in guzzlehttp/guzzle7.15.1. The patch introduces a host-only flag on stored cookies and enforces exact host matching when the Set-Cookie header omits a Domain attribute. Full remediation details are published in the GitHub Security Advisory and the VulnCheck Advisory.
Workarounds
- Instantiate a separate CookieJar for every distinct host the application communicates with.
- Disable cookie persistence entirely by passing ['cookies' => false] in client configuration when cookies are not required.
- Strip sensitive cookies from outbound requests using middleware before requests reach untrusted hosts.
# Configuration example
composer require guzzlehttp/guzzle:^7.15.1
composer update guzzlehttp/guzzle
composer show guzzlehttp/guzzle | grep versions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
