DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-WM3W-8RRP-J577: GHSA-WM3W-8RRP-J577: Host-Only Cookie Scope Exposure in Guzzle Cookie Jar

#security #cve #cybersecurity #ghsa

GHSA-WM3W-8RRP-J577: Host-Only Cookie Scope Exposure in Guzzle Cookie Jar

Vulnerability ID: GHSA-WM3W-8RRP-J577
CVSS Score: 7.5
Published: 2026-07-20

An information disclosure vulnerability in guzzlehttp/guzzle allows host-only cookies to be incorrectly matched and sent to subdomains. Because Guzzle failed to track whether cookies were defined without a Domain attribute, it evaluated host-only cookies using standard domain-suffix rules, widening their scope and exposing sensitive session tokens to untrusted subdomains.

TL;DR

Guzzle failed to track whether cookies were originally set without a Domain attribute, causing host-only cookies to be incorrectly forwarded to subdomains and potentially exposing sensitive sessions.

⚠️ Exploit Status: POC

Technical Details

  • Vulnerability Type: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  • Attack Vector: Network
  • CVSS Score: 7.5
  • Exploit Status: Proof of Concept (PoC) documented
  • Affected Components: GuzzleHttp\Cookie\CookieJar
  • CISA KEV Status: Not Listed

Affected Systems

  • guzzlehttp/guzzle
  • guzzlehttp/guzzle: < 7.15.1 (Fixed in: 7.15.1)

Code Analysis

Commit: 7b68220

Fix host-only cookie scope and enforce strict validation on persistent jars

--- a/src/Cookie/SetCookie.php
+++ b/src/Cookie/SetCookie.php
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade the guzzlehttp/guzzle dependency to version 7.15.1 or later.
  • Clear or regenerate legacy stored cookie jar files to avoid RuntimeExceptions caused by the new strict schema validation.
  • Ensure separate CookieJar instances are utilized when communicating with distinct host domains and untrusted subdomains.

Remediation Steps:

  1. Run 'composer update guzzlehttp/guzzle' in the project directory to update Guzzle to at least version 7.15.1.
  2. Locate and delete any persistent JSON cookie storage files managed by FileCookieJar or SessionCookieJar to prevent serialization crashes.
  3. Deploy the updated application and monitor error logs for any unhandled RuntimeException instances during cookie jar loading.

References

Read the full report for GHSA-WM3W-8RRP-J577 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)