Cookie Exposure in Guzzle HTTP Client

Executive Summary

CVE-2026-59883 is a security vulnerability in the Guzzle PHP HTTP client library prior to version 7.12.3. The issue arises because the CookieJar component did not properly restrict cookies scoped to IP addresses or bare numeric domain values to the exact host that set them. Instead, it applied ordinary suffix matching to such domains (e.g., 192.168.0.1, [::1], or 1), which allowed cookies to be sent to other hosts with similar numeric patterns.

This improper handling violates RFC 6265, which requires that cookies scoped to IP addresses or numeric hosts must match exactly the host that set them. Because of this, an attacker could exploit the vulnerability by causing cross-host cookie disclosure, cookie injection, or session fixation attacks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to several security impacts including cross-host cookie disclosure, where cookies intended for one host could be accessed by another host with a similar numeric domain. It also enables cookie injection, allowing an attacker to insert malicious cookies, and session fixation, where an attacker can fixate a user's session by controlling cookies.

Such impacts can compromise user privacy and security by exposing sensitive session information or enabling unauthorized access to user sessions.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improper handling of cookies scoped to IP addresses or numeric domains in the Guzzle HTTP client library prior to version 7.12.3. Detection would involve identifying if your system or network is using a vulnerable version of Guzzle and if cookies scoped to IP addresses or bare numeric domains are being used or transmitted improperly.

Since the issue is related to cookie domain matching, you can monitor HTTP traffic for cookies with IP address or numeric domain attributes that are being sent to hosts other than the exact IP address that set them.

Suggested commands to detect this behavior could include using network traffic analysis tools like tcpdump or Wireshark to filter HTTP cookie headers and inspect their domain attributes.

• Use tcpdump to capture HTTP traffic and filter for cookie headers: tcpdump -i <interface> -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep -i 'Cookie'
• Use Wireshark to filter HTTP traffic with the display filter: http.cookie
• Inspect captured cookies for domain attributes that are IP addresses or numeric values and verify if they are sent to hosts other than the exact IP address.

Additionally, check the version of Guzzle used in your applications by inspecting your dependency manager (e.g., composer) to see if it is older than 7.12.3.

Useful 0 Not Useful 0

Mitigation Strategies

The primary and recommended mitigation for this vulnerability is to upgrade the Guzzle HTTP client library to version 7.12.3 or later, where the issue is fixed.

Other mitigation steps include:

• Avoid scoping cookies to IP addresses or bare numeric domains.
• Use separate cookie jars per host or trust boundary to prevent cross-host cookie leakage.

These steps help prevent cross-host cookie disclosure, cookie injection, or session fixation attacks that could arise from the vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Guzzle's CookieJar component allows cross-host cookie disclosure, cookie injection, or session fixation by improperly handling cookies scoped to IP addresses or numeric domains. This can lead to unintended exposure of sensitive session or user information across hosts.

Such information exposure and session fixation issues can negatively impact compliance with data protection standards and regulations like GDPR and HIPAA, which require strict controls on personal data confidentiality and session security.

By allowing cookies to be sent to unintended hosts, the vulnerability increases the risk of unauthorized access or data leakage, which could result in violations of these regulations.

Mitigations include upgrading to Guzzle version 7.12.3 or later, which enforces exact matching for IP and numeric cookie domains, thereby reducing the risk of cross-host cookie leakage and improving compliance posture.

Useful 0 Not Useful 0