CVE-2026-59883
CVE-2026-59883 · Guzzle: Cookie Disclosure and Injection via IP-Address Domains
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain values to the exact host that set them, because SetCookie::matchesDomain() applied ordinary suffix matching to domains such as 192.168.0.1, [::1], or 1, allowing cross-host cookie disclosure, cookie injection, or session fixation. This issue is fixed in version 7.12.3.
CVSS 4.7 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
guzzle
- Versions
- < 7.12.3: Affected
No fix published
guzzle Debian:12
- Versions
- 7.11.0-1
- 7.12.0-1
- 7.12.1-1
- 7.12.3-1
- 7.13.1-1
- 7.14.0-1
- 7.14.1-1
- 7.14.2-1
- 7.15.0-1
- 7.15.1-1
- 7.15.2-1
- 7.15.3-1
- 7.15.5-1
- 7.4.5-1
- 7.9.2-0.1
- 8.0.1-1
- 8.0.2-1
- 8.1.0-1
- 8.2.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
guzzle Debian:13
- Versions
- 7.11.0-1
- 7.12.0-1
- 7.12.1-1
- 7.12.3-1
- 7.13.1-1
- 7.14.0-1
- 7.14.1-1
- 7.14.2-1
- 7.15.0-1
- 7.15.1-1
- 7.15.2-1
- 7.15.3-1
- 7.15.5-1
- 7.9.2-0.1
- 8.0.1-1
- 8.0.2-1
- 8.1.0-1
- 8.2.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
guzzle Debian:14
- Versions
- 7.11.0-1
- 7.12.0-1
- 7.12.1-1
- 7.9.2-0.1
- Affected ranges
- ECOSYSTEM: < 7.12.3-1
Update to 7.12.3-1
guzzlehttp/guzzle Packagist
- Versions
- 4.0.0
- 4.0.0-rc.1
- 4.0.0-rc.2
- 4.0.1
- 4.0.2
- 4.1.0
- 4.1.1
- 4.1.2
- 4.1.3
- 4.1.4
- 4.1.5
- 4.1.6
- 4.1.7
- 4.1.8
- 4.2.0
- 4.2.1
- 4.2.2
- 4.2.3
- 4.2.4
- 5.0.0
- 5.0.1
- 5.0.2
- 5.0.3
- 5.1.0
- 5.2.0
- 5.3.0
- 5.3.1
- 5.3.2
- 5.3.3
- 5.3.4
- 6.0.0
- 6.0.1
- 6.0.2
- 6.1.0
- 6.1.1
- 6.2.0
- 6.2.1
- 6.2.2
- 6.2.3
- 6.3.0
- 6.3.1
- 6.3.2
- 6.3.3
- 6.4.0
- 6.4.1
- 6.5.0
- 6.5.1
- 6.5.2
- 6.5.3
- 6.5.4
- 6.5.5
- 6.5.6
- 6.5.7
- 6.5.8
- 7.0.0
- 7.0.0-beta.1
- 7.0.0-beta.2
- 7.0.0-rc.1
- 7.0.1
- 7.1.0
- 7.1.1
- 7.10.0
- 7.10.1
- 7.10.2
- 7.10.3
- 7.10.4
- 7.10.5
- 7.10.6
- 7.11.0
- 7.11.1
- 7.11.2
- 7.12.0
- 7.12.1
- 7.12.2
- 7.2.0
- 7.3.0
- 7.4.0
- 7.4.1
- 7.4.2
- 7.4.3
- 7.4.4
- 7.4.5
- 7.5.0
- 7.5.1
- 7.5.2
- 7.5.3
- 7.6.0
- 7.6.1
- 7.7.0
- 7.7.1
- 7.8.0
- 7.8.1
- 7.8.2
- 7.9.0
- 7.9.1
- 7.9.2
- 7.9.3
- v1.0.3
- v1.0.4
- v2.0.0
- v2.0.1
- v2.0.2
- v2.0.3
- v2.0.4
- v2.0.5
- v2.1.0
- v2.1.1
- v2.1.2
- v2.1.3
- v2.1.4
- v2.2.0
- v2.2.1
- v2.2.2
- v2.2.3
- v2.2.4
- v2.3.2
- v2.4.0
- v2.4.1
- v2.5.0
- v2.6.0
- v2.6.1
- v2.6.2
- v2.6.3
- v2.6.4
- v2.6.5
- v2.6.6
- v2.7.0
- v2.7.1
- v2.7.2
- v2.8.0
- v2.8.1
- v2.8.2
- v2.8.3
- v2.8.4
- v2.8.5
- v2.8.6
- v2.8.7
- v2.8.8
- v3.0.0
- v3.0.1
- v3.0.2
- v3.0.3
- v3.0.4
- v3.0.5
- v3.0.6
- v3.0.7
- v3.1.0
- v3.1.1
- v3.1.2
- v3.2.0
- v3.3.0
- v3.3.1
- v3.4.0
- v3.4.1
- v3.4.2
- v3.4.3
- v3.5.0
- v3.6.0
- v3.7.0
- v3.7.1
- v3.7.2
- v3.7.3
- v3.7.4
- v3.8.0
- v3.8.1
- Affected ranges
- ECOSYSTEM: < 7.12.3
Update to 7.12.3
guzzle Ubuntu:24.04:LTS
- Versions
- 7.4.5-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
guzzle Ubuntu:25.10
- Versions
- 7.9.2-0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
guzzle Ubuntu:26.10
- Versions
- 7.9.2-0.1build1
- 7.13.1-1
- 7.15.1-1
- 7.15.2-1
- 7.15.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
guzzle Ubuntu:26.04:LTS
- Versions
- 7.9.2-0.1
- 7.9.2-0.1build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published