CVE-2026-67355 in Guzzle
Summary
by MITRE • 08/01/2026
guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session identifiers and authorization tokens when the same cookie jar is reused across trust boundaries.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability in guzzlehttp/guzzle versions prior to 7.15.1 represents a critical cookie handling flaw that undermines web application security through improper domain scope management. This issue stems from the library's failure to correctly implement host-only cookie semantics as defined in rfc6265, where cookies explicitly marked with host-only scope should not be sent to subdomains or child hosts. The technical implementation error occurs during cookie storage when the library incorrectly populates the Domain field of host-only cookies with the request host instead of properly marking them as host-only, effectively breaking the security boundary between parent and child domains.
The operational impact of this vulnerability extends beyond simple session management issues, creating potential attack vectors for cross-domain cookie leakage that can compromise authentication mechanisms and authorization tokens. When attackers control or can influence child hosts within a domain hierarchy, they can intercept cookies that should remain isolated to parent domains, particularly when the same cookie jar is reused across different trust boundaries within an application. This behavior violates fundamental security principles outlined in cwe-384 and aligns with attack patterns described in the mitre att&ck framework under initial access and credential access techniques, where adversaries exploit misconfigured session management to escalate privileges or maintain persistent access.
The vulnerability demonstrates a failure in proper cookie validation and storage mechanisms that should adhere to established web security standards and protocol specifications. Modern web applications rely on strict domain scope enforcement to prevent cookie hijacking attacks, particularly in environments with complex domain hierarchies or microservices architectures where trust boundaries between services are critical. The fix implemented in version 7.15.1 addresses this by ensuring that host-only cookies are properly marked without domain attributes, preventing unintended cross-domain cookie transmission while maintaining backward compatibility for standard cookie operations.
Organizations utilizing guzzlehttp/guzzle should prioritize immediate patching of affected versions to prevent potential exploitation, particularly in applications handling sensitive authentication data or operating in environments with multiple interconnected domains. Security teams should monitor for instances where the same cookie jar is shared across different trust boundaries and implement additional controls such as explicit domain validation or cookie isolation mechanisms to mitigate residual risks. The vulnerability serves as a reminder of the critical importance of proper session management in web applications and highlights how seemingly minor implementation details can create significant security vulnerabilities that align with established attack patterns and threat models.