CVE-2026-67355
Received Received - Intake

GuzzleHTTP Cookie Scope Bypass Before 7.15.1

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session identifiers and authorization tokens when the same cookie jar is reused across trust boundaries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-67355
EUVD
EUVD-2026-51845

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
guzzlehttp guzzle to 7.15.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-201 The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects guzzlehttp/guzzle versions before 7.15.1. It fails to preserve host-only cookie scope by storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended for parent hosts, potentially exposing session identifiers and authorization tokens when the same cookie jar is reused across trust boundaries.

Impact Analysis

If you use an affected version of guzzlehttp/guzzle, attackers could intercept host-only cookies meant for parent domains. This could lead to unauthorized access to sensitive data like session tokens or authorization credentials, especially if cookies are shared across different trust boundaries.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations using affected versions may face compliance risks due to potential data breaches and unauthorized data exposure.

Mitigation Strategies

Upgrade guzzlehttp/guzzle to version 7.15.1 or later to fix the cookie scope issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67355. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart