CVE-2026-69245: Guzzle PHP HTTP Client Cookie Vulnerability

CVE-2026-69245 Overview

CVE-2026-69245 is a domain-scoping flaw in Guzzle, the extensible PHP HTTP client. Versions prior to 7.15.2 and 8.0.1 mishandle numeric and percent-encoded host forms in SetCookie::matchesDomain(). The function fails to recognize hexadecimal literals such as 0x7f000001, mixed-base forms like 0177.0.0.0x1, and percent-escaped hosts such as 192.168.0.%31 as IP addresses. Meanwhile, libcurl 8.21.0 resolves these spellings to real addresses. The mismatch allows a cookie scoped to Domain=0x7f000001 to be sent to evil.0x7f000001, disclosing session identifiers or tokens to an unrelated host. This issue maps to [CWE-180: Incorrect Behavior Order: Validate Before Canonicalize].

Critical Impact
Session tokens and cookies scoped to numeric or percent-encoded hosts can leak to look-alike subdomains, enabling session fixation or theft when applications use Guzzle with cookie support enabled.

Affected Products

Guzzle HTTP client versions prior to 7.15.2 (7.x branch)
Guzzle HTTP client versions prior to 8.0.1 (8.x branch)
PHP applications using Guzzle with cookie jar support enabled

Discovery Timeline

2026-08-03 - CVE-2026-69245 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-69245

Vulnerability Analysis

The flaw resides in SetCookie::matchesDomain(), which determines whether a stored cookie should be attached to an outgoing request. The method treats any host as a registered domain name unless it recognizes the value as an IP literal. Its numeric-host detection only matches dotted-quad IPv4 form. Hexadecimal notation, mixed-base octet forms, and percent-encoded octets bypass this classification. libcurl, however, performs percent-decoding before resolving the host and accepts multiple numeric bases. This inconsistency between Guzzle's cookie scoping and the underlying transport creates a gap where subdomain matching applies to values that are actually addresses on the wire.

Root Cause

The root cause is an ordering error between validation and canonicalization. Guzzle validates cookie domain scope against the raw textual form. libcurl canonicalizes the host via percent-decoding and numeric parsing before resolution. Two spellings the transport reads as the same address are treated as distinct string labels by the cookie layer, so subdomain scope is preserved for what should be a bare IP host.

Attack Vector

An attacker registers or controls a hostname ending in one of these numeric spellings, for example evil.0x7f000001. When a Guzzle-based application contacts the origin 0x7f000001 with cookie support enabled, cookies scoped to that domain are transmitted to any subdomain match. A response from the attacker-controlled host setting Domain=0x7f000001 is stored in the jar and later replayed. This enables session fixation, cookie theft, and application state manipulation against the resolved IP target.

php

// Security patch in src/Cookie/SetCookie.php - Security fixes 7.15 (#3907)
namespace GuzzleHttp\Cookie;

use GuzzleHttp\Handler\HostValidator;
use GuzzleHttp\Psr7;

Source: GitHub Commit 744101956d78b7c1384d0cbf379db13e859167bf

php

// Security patch in src/Handler/CurlHandler.php - Security fixes 8.0 (#3908)
    array $options
): PromiseInterface {
    $this->assertOpen();
    HostValidator::assertRequestHost($request);

    if (isset($options['delay'])) {
        \usleep((int) ($options['delay'] * 1000));

Source: GitHub Commit 3aeea0406aab88cbbd86531313d7cebf8ae149a4. The fix introduces a HostValidator class that rejects ambiguous host spellings before the request reaches the transport.

Detection Methods for CVE-2026-69245

Indicators of Compromise

Outbound HTTP requests to hosts using hexadecimal IP literals such as 0x7f000001 or mixed-base forms like 0177.0.0.0x1.
Request URLs containing percent-escaped host octets such as 192.168.0.%31 or 127.0.0.1%2e.
Cookie headers sent to hosts whose FQDN terminates in a numeric or percent-encoded label matching a previously visited origin.
Set-Cookie responses with Domain= attributes containing non-standard numeric IP encodings.

Detection Strategies

Inventory PHP projects and Composer lock files for guzzlehttp/guzzle versions below 7.15.2 or 8.0.1.
Instrument HTTP egress proxies to log and alert on host labels containing 0x, leading zeros, or percent-encoded characters in the authority component.
Review application logs for cookie jar entries whose Domain attribute is not a standard DNS name or dotted-quad IPv4 address.

Monitoring Recommendations

Monitor DNS resolutions for hostnames ending in numeric or hex-encoded labels originating from application servers.
Track Composer dependency updates in CI pipelines and fail builds pinned to affected Guzzle ranges.
Alert on outbound traffic where the HTTP Host header differs in canonical form from the resolved IP address.

How to Mitigate CVE-2026-69245

Immediate Actions Required

Upgrade Guzzle to 7.15.2 on the 7.x branch or 8.0.1 on the 8.x branch immediately.
Audit application code paths that pass user-supplied URLs to Guzzle with cookies enabled and reject non-standard host forms.
Rotate session identifiers and application tokens issued to origins addressed by numeric or percent-encoded hostnames.

Patch Information

Fixed versions are available in GitHub Release 7.15.2 and GitHub Release 8.0.1. Technical details are documented in GitHub Security Advisory GHSA-f7vp-7xgx-4w4r, with fixes landed in Pull Request #3907 and Pull Request #3908. The patches introduce HostValidator::assertRequestHost() to reject ambiguous host encodings before dispatch.

Workarounds

Disable Guzzle's cookie jar by omitting the cookies request option where cookies are not required.
Normalize and validate URLs before passing them to Guzzle, rejecting authority components containing 0x, leading zeros, or percent-encoded characters.
Restrict outbound HTTP egress at the network layer to an allow-list of known destination hostnames.

bash

# Composer commands to remediate
composer require guzzlehttp/guzzle:^7.15.2
# or for the 8.x branch
composer require guzzlehttp/guzzle:^8.0.1
composer show guzzlehttp/guzzle | grep versions