DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-69245: CVE-2026-69245: Noncanonical Cookie Domain Keeps Subdomain Scope in Guzzle

#security #cve #cybersecurity

CVE-2026-69245: Noncanonical Cookie Domain Keeps Subdomain Scope in Guzzle

Vulnerability ID: CVE-2026-69245
CVSS Score: 6.5
Published: 2026-08-03

A vulnerability in the Guzzle HTTP client allows session identifiers, auth tokens, or cookies to be leaked to unauthorized hosts due to incorrect cookie domain validation of noncanonical IPv4 host formats. Guzzle failed to recognize octal, hexadecimal, and percent-encoded IP addresses as IP literals, treating them as standard domains and incorrectly extending their scope to subdomains.

TL;DR

Guzzle's cookie matching logic failed to identify noncanonical IPv4 host formats (like hexadecimal, octal, or percent-encoded) as IP literals, incorrectly applying standard suffix/subdomain matching and leaking sensitive cookies to attacker-controlled subdomains.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-180, CWE-346, CWE-384
  • Attack Vector: Network (AV:N)
  • Attack Complexity: Low (AC:L)
  • CVSS Severity: 6.5 Medium
  • EPSS Score: Not Available
  • Exploit Status: Proof-of-Concept
  • CISA KEV Status: Not Listed

Affected Systems

  • Guzzle (PHP HTTP Client)
  • Guzzle: < 7.15.2 (Fixed in: 7.15.2)
  • Guzzle: >= 8.0.0, < 8.0.1 (Fixed in: 8.0.1)

Code Analysis

Commit: 7441019

Security fixes to branch 7.15

Commit: 3aeea04

Security fixes to branch 8.0

Mitigation Strategies

  • Upgrade Guzzle to version 7.15.2 or 8.0.1 and above.
  • Strictly validate and canonicalize input IP addresses using filter_var() before passing them to the HTTP client.
  • Implement WAF or proxy rules to detect and block noncanonical IP host formats (hexadecimal, octal, percent-encoded) in outbound requests.

Remediation Steps:

  1. Identify all Guzzle installations within the dependency tree (composer.lock).
  2. Run 'composer update guzzlehttp/guzzle' to fetch the latest patched version.
  3. Verify the installed version is either >= 7.15.2 or >= 8.0.1.

References

Read the full report for CVE-2026-69245 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)