Vulnerability advisory

CVE-2026-59883

Guzzle: Cookie Disclosure and Injection via IP-Address Domains

Published Jul 8, 2026Updated Oct 28, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/guzzle/guzzle ↗
All commits before 9aa17bcdd777ee31df9fc83c337ca4ca2340def3	`9aa17bcdd777ee31df9fc83c337ca4ca2340def3`
Not specified	`b9944c161b12d9ee9c9334cfc5b9659ecd7451f8`
Also listed as affected (143) `7.12.2` `7.12.1` `7.12.0` `7.11.0` `7.10.0` `7.9.3` `7.9.2` `7.9.1` `7.9.0` `7.8.1` `7.8.0` `7.7.0` `7.6.1` `7.6.0` `7.5.1` `7.5.0` `7.4.5` `7.4.4` `7.4.3` `7.4.2` `7.4.1` `7.4.0` `7.3.0` `7.2.0` `7.1.1` `7.1.0` `7.0.0` `7.0.0-rc.1` `7.0.0-beta.2` `7.0.0-beta.1` `6.5.0` `6.4.1` `6.4.0` `6.3.3` `6.3.2` `6.3.1` `6.3.0` `6.2.2` `6.2.1` `4.2.3` `6.2.0` `6.1.1` `6.1.0` `6.0.2` `6.0.1` `6.0.0` `5.3.0` `5.2.0` `5.1.0` `5.0.3` `5.0.2` `5.0.1` `5.0.0` `4.2.2` `4.2.1` `4.2.0` `4.1.8` `4.1.7` `4.1.6` `4.1.5` `4.1.4` `4.1.3` `4.1.2` `4.1.1` `4.1.0` `4.0.2` `4.0.1` `4.0.0` `4.0.0-rc.2` `4.0.0-rc.1` `v3.8.1` `v3.8.0` `v3.7.4` `v3.7.3` `v3.7.2` `v3.7.1` `v3.7.0` `v3.6.0` `v3.5.0` `v3.4.3` `v3.4.2` `v3.4.1` `v3.4.0` `v3.3.1` `v3.3.0` `v3.2.0` `v3.1.2` `v3.1.1` `v3.1.0` `v3.0.7` `v3.0.6` `v3.0.5` `v3.0.4` `v3.0.3` `v3.0.2` `v3.0.1` `v3.0.0` `v2.8.8` `v2.8.7` `v2.8.6` `v2.8.5` `v2.8.4` `v2.8.3` `v2.8.2` `v2.8.1` `v2.8.0` `v2.7.2` `v2.7.1` `v2.7.0` `v2.6.6` `v2.6.5` `v2.6.4` `v2.6.3` `v2.6.2` `v2.6.1` `v2.6.0` `v2.5.0` `v2.4.1` `v2.4.0` `v2.3.2` `v2.3.1` `v2.3.0` `v2.2.4` `v2.2.3` `v2.2.2` `v2.2.1` `v2.2.0` `v2.1.4` `v2.1.3` `v2.1.2` `v2.1.1` `v2.1.0` `v2.0.5` `v2.0.4` `v2.0.3` `v2.0.2` `v2.0.1` `v2.0.0` `v1.0.3` `v1.0.2` `v1.0.1` `v1.0.0` `v1.0.0beta1`

Description

Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain values to the exact host that set them, because SetCookie::matchesDomain() applied ordinary suffix matching to domains such as 192.168.0.1, [::1], or 1, allowing cross-host cookie disclosure, cookie injection, or session fixation. This issue is fixed in version 7.12.3.

CVE-2026-59883

Affected versions

Repository

Description

References