CVE-2026-59883: CVE-2026-59883: Cookie Disclosure and Injection via IP-Address Domains in Guzzle HTTP Client

#security #cve #cybersecurity

CVE-2026-59883: Cookie Disclosure and Injection via IP-Address Domains in Guzzle HTTP Client

Vulnerability ID: CVE-2026-59883
CVSS Score: 4.7
Published: 2026-07-20

Guzzle HTTP Client prior to version 7.12.3 contains a logical flaw in its CookieJar component. The client fails to properly validate the host types of stored cookie domain attributes before applying standard suffix-matching logic. As a consequence, sensitive session cookies scoped to an IP address (e.g., 192.168.0.1) can be leaked to malicious, look-alike hostnames (e.g., evil.192.168.0.1). This vulnerability permits cross-host cookie disclosure, cookie injection, and session fixation attacks.

TL;DR

Guzzle HTTP Client before version 7.12.3 incorrectly applies suffix matching to cookie domains scoped to literal IP addresses, allowing sensitive cookies to be leaked to unauthorized look-alike subdomains.

Technical Details

CWE ID: CWE-346 (Origin Validation Error)
Attack Vector: Network
CVSS v3.1: 4.7
EPSS Score: 0.00115
Impact: Cross-Host Cookie Disclosure / Injection
Exploit Status: none
CISA KEV Status: Not Listed

Affected Systems

Guzzle HTTP Client (PHP Package: guzzlehttp/guzzle)
guzzlehttp/guzzle: < 7.12.3 (Fixed in: 7.12.3)

Code Analysis

Commit: b9944c1

Treat IP and numeric cookie domains as exact-match-only (GHSA-g446-98w2-8p5w)

diff --git a/src/Cookie/SetCookie.php b/src/Cookie/SetCookie.php
index b4962ef..cb4d42a 100644
--- a/src/Cookie/SetCookie.php
+++ b/src/Cookie/SetCookie.php
@@ -460,6 +460,12 @@ public function matchesDomain(string $domain): bool
             return true;
         }

+        // IP literals and numeric hosts are exact-match-only per RFC 6265.
+        // Only the exact match above may succeed for those cookie domains.
+        if (self::isIpAddressOrNumericHost($cookieDomain)) {
+            return false;
+        }
+

Mitigation Strategies

Upgrade Guzzle HTTP Client to version 7.12.3 or later
Disable CookieJar middleware when making requests targeting raw IP addresses
Implement a custom PSR-7 middleware to strip the domain attribute from Set-Cookie headers targeting raw IP addresses

Remediation Steps:

Open a terminal in your project root containing the Composer configuration.
Execute the command: composer update guzzlehttp/guzzle
Verify the upgrade by executing: composer show guzzlehttp/guzzle
Confirm the installed version is 7.12.3 or higher.

References

Read the full report for CVE-2026-59883 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community