Guzzle up to 7.12.0 Cookie Domain SetCookie::matchesDomain origin validation

Summaryinfo

A vulnerability identified as problematic has been detected in Guzzle up to 7.12.0. Impacted is the function SetCookie::matchesDomain of the component Cookie Domain Handler. Performing a manipulation results in origin validation. This vulnerability is reported as CVE-2026-55767. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Guzzle up to 7.12.0. This affects the function SetCookie::matchesDomain of the component Cookie Domain Handler. The manipulation with an unknown input leads to a origin validation vulnerability. CWE is classifying the issue as CWE-346. The product does not properly verify that the source of data or communication is valid. This is going to have an impact on integrity. The summary by CVE is:

Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar incorrectly accepts cookies with a dot-only Domain attribute and whitespace-padded variants. SetCookie::matchesDomain() removes leading dots from the cookie domain, normalizing dot-only values to the empty string; SetCookie::validate() only rejected a strictly empty domain, so these cookies could be stored and the empty normalized domain was treated as matching any request host. An attacker-controlled origin that an application requests with a shared cookie jar can therefore set a cookie that Guzzle later sends to unrelated hosts using the same jar. This may allow cookie injection or session fixation against downstream services, depending on how those services interpret the injected cookie. This vulnerability is fixed in 7.12.1.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-55767 since 06/17/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 7.12.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Guzzle

Version

• 7.0
• 7.1
• 7.2
• 7.3
• 7.4
• 7.5
• 7.6
• 7.7
• 7.8
• 7.9
• 7.10
• 7.11
• 7.12.0

Website

• Product: https://github.com/guzzle/guzzle/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion