CVEvulnerability

CVE-2026-59883

6.1 MEDIUM Published 2026-07-08 Modified 2026-07-13 Official page ↗
Status
Analyzed
Published
2026-07-08
Last modified
2026-07-13
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.7 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-346, CWE-384

Description

Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain values to the exact host that set them, because SetCookie::matchesDomain() applied ordinary suffix matching to domains such as 192.168.0.1, [::1], or 1, allowing cross-host cookie disclosure, cookie injection, or session fixation. This issue is fixed in version 7.12.3.

Affected configurations

• guzzlephp guzzle (< 7.12.3)

Related

Weakness · CWE (2)

  • CWE-346 Origin Validation Error weakness
  • CWE-384 Session Fixation weakness

References