Vulnerability in Guzzle
CVE-2026-59883
Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain values to the exact host that set them, because SetCookie::matchesDomain() applied ordinary suffix matching to domains such as 192.168.0.1, [::1], or 1, allowing cross-host cookie disclosure, cookie injection, or session fixation. This issue is fixed in version 7.12.3.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.7 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.002 (5.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 5th percentile — 5.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Guzzle — versions < 7.12.3
- Guzzlephp Guzzle
Weakness classification (CWE)
References
- github.com/guzzle/guzzle/security/advisories/GHSA-g446-98w2-8p5w (Mitigation, Vendor Advisory)
- github.com/guzzle/guzzle/pull/3694 (Patch, Issue Tracking)
- github.com/guzzle/guzzle/commit/b9944c161b12d9ee9c9334cfc5b9659ecd7451f8 (Patch)
- github.com/guzzle/guzzle/releases/tag/7.12.3 (Release Notes)
Frequently asked questions
- What is CVE-2026-59883?
- CVE-2026-59883 is a medium-severity vulnerability in Guzzle, classified under Origin Validation Error. CVSS score: 4.7/10. Published 2026-07-08.
- How severe is CVE-2026-59883?
- Medium severity. CVSS v3 base score is 4.7 out of 10.