Vulnerability in Guzzle
CVE-2026-55767
Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar incorrectly accepts cookies with a dot-only Domain attribute and whitespace-padded variants. SetCookie::matchesDomain() removes leading dots from the cookie domain, normalizing dot-only values to the empty string; SetCookie::validate() only rejected a strictly empty domain, so these cookies could be stored and the empty normalized domain was treated as matching any request host. An attacker-controlled origin that an application requests with a shared cookie jar can therefore set a cookie that Guzzle later sends to unrelated hosts using the same jar. This may allow cookie injection or session fixation against downstream services, depending on how those services interpret the injected cookie. This vulnerability is fixed in 7.12.1.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.002 (10.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 10th percentile — 10.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Guzzle — versions < 7.12.1
- Guzzlephp Guzzle
Weakness classification (CWE)
References
- github.com/guzzle/guzzle/security/advisories/GHSA-cwxw-98qj-8qjx (Third Party Advisory)
- github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2…
- github.com/guzzle/guzzle/commit/7f537cded1912349abf5081258d6db19106d774d
- github.com/guzzle/guzzle/pull/3653
- github.com/guzzle/guzzle/releases/tag/7.12.1
Frequently asked questions
- What is CVE-2026-55767?
- CVE-2026-55767 is a medium-severity vulnerability in Guzzle, classified under Origin Validation Error. CVSS score: 5.8/10. Published 2026-06-23.
- How severe is CVE-2026-55767?
- Medium severity. CVSS v3 base score is 5.8 out of 10.