Fluid Attacks Database

Description

guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session identifiers and authorization tokens when the same cookie jar is reused across trust boundaries.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 13	guzzle	=7.11.0-1 \|\| =7.12.0-1 \|\| =7.12.1-1 \|\| =7.12.3-1 \|\| =7.13.1-1 \|\| =7.14.0-1 \|\| =7.14.1-1 \|\| =7.14.2-1 \|\| =7.15.0-1 \|\| =7.15.1-1 \|\| =7.15.2-1 \|\| =7.15.3-1 \|\| =7.15.5-1 \|\| =7.9.2-0.1 \|\| =8.0.1-1 \|\| =8.0.2-1 \|\| =8.1.0-1 \|\| =8.2.0-1	-
debian 14	guzzle	=7.11.0-1 \|\| =7.12.0-1 \|\| =7.12.1-1 \|\| =7.12.3-1 \|\| =7.13.1-1 \|\| =7.14.0-1 \|\| =7.14.1-1 \|\| =7.14.2-1 \|\| =7.15.0-1 \|\| =7.9.2-0.1 \|\| >=0 <7.15.1-1	7.15.1-1
packagist	guzzlehttp/guzzle	>=0 <7.15.1	7.15.1
debian 12	guzzle	=7.11.0-1 \|\| =7.12.0-1 \|\| =7.12.1-1 \|\| =7.12.3-1 \|\| =7.13.1-1 \|\| =7.14.0-1 \|\| =7.14.1-1 \|\| =7.14.2-1 \|\| =7.15.0-1 \|\| =7.15.1-1 \|\| =7.15.2-1 \|\| =7.15.3-1 \|\| =7.15.5-1 \|\| =7.4.5-1 \|\| =7.9.2-0.1 \|\| =8.0.1-1 \|\| =8.0.2-1 \|\| =8.1.0-1 \|\| =8.2.0-1	-

Aliases

1. CVE-2026-673552. NVD-2026-673553. OSV-DEBIAN-2026-673554. OSV-2026-673555. GHSA-wm3w-8rrp-j5776. GCVE-2026-673557. SECURITY-TRACKER-CVE-2026-67355

References

1. https://github.com/guzzle/guzzle/security/advisories/GHSA-wm3w-8rrp-j5772. https://github.com/guzzle/guzzle/pull/39013. https://github.com/guzzle/guzzle/commit/7b68220d6543f6f80fe62e633361fc9d4ead14d44. https://github.com/guzzle/guzzle/releases/tag/7.15.15. https://www.vulncheck.com/advisories/guzzlehttp-guzzle-before-host-only-cookie-scope

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.