PHP HTTP Client Cookie Handling Vulnerability in Guzzle
CVE-2026-69245
6.5MEDIUM
What is CVE-2026-69245?
Guzzle, an extensible PHP HTTP client, contains a vulnerability in its cookie domain matching mechanism prior to versions 7.15.2 and 8.0.1. The affected versions allow every subdomain of a specified Domain to access the cookie, unless the Domain is recognized as an IP or a numeric host. This can lead to session identifiers or tokens being disclosed to malicious hosts. Specifically, certain hexadecimal and percent-escaped domains may be improperly recognized. Exploitation requires the application to enable cookie support and interact with a vulnerable domain format, allowing attackers to intercept sensitive session information or manipulate application state.
Affected Version(s)
guzzle < 7.15.2 < 7.15.2
guzzle >= 8.0.0, < 8.0.1 < 8.0.0, 8.0.1