Vulnerability advisory

CVE-2026-67355

guzzlehttp/guzzle before 7.15.1 Host-only Cookie Scope

Published Aug 1, 2026Updated Oct 28, 2026OSV record ↗

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/guzzle/guzzle ↗
All commits before 61443dfb33c62f308ee8add20f45b4d6e4bf8d2f	`61443dfb33c62f308ee8add20f45b4d6e4bf8d2f`
Also listed as affected (144) `7.15.0` `7.14.0` `7.13.1` `7.13.0` `7.11.0` `7.10.0` `7.9.3` `7.9.2` `7.9.1` `7.9.0` `7.8.1` `7.8.0` `7.7.0` `7.6.1` `7.6.0` `7.5.1` `7.5.0` `7.4.5` `7.4.4` `7.4.3` `7.4.2` `7.4.1` `7.4.0` `7.3.0` `7.2.0` `7.1.1` `7.1.0` `7.0.0` `7.0.0-rc.1` `7.0.0-beta.2` `7.0.0-beta.1` `6.5.0` `6.4.1` `6.4.0` `6.3.3` `6.3.2` `6.3.1` `6.3.0` `6.2.2` `6.2.1` `4.2.3` `6.2.0` `6.1.1` `6.1.0` `6.0.2` `6.0.1` `6.0.0` `5.3.0` `5.2.0` `5.1.0` `5.0.3` `5.0.2` `5.0.1` `5.0.0` `4.2.2` `4.2.1` `4.2.0` `4.1.8` `4.1.7` `4.1.6` `4.1.5` `4.1.4` `4.1.3` `4.1.2` `4.1.1` `4.1.0` `4.0.2` `4.0.1` `4.0.0` `4.0.0-rc.2` `4.0.0-rc.1` `v3.8.1` `v3.8.0` `v3.7.4` `v3.7.3` `v3.7.2` `v3.7.1` `v3.7.0` `v3.6.0` `v3.5.0` `v3.4.3` `v3.4.2` `v3.4.1` `v3.4.0` `v3.3.1` `v3.3.0` `v3.2.0` `v3.1.2` `v3.1.1` `v3.1.0` `v3.0.7` `v3.0.6` `v3.0.5` `v3.0.4` `v3.0.3` `v3.0.2` `v3.0.1` `v3.0.0` `v2.8.8` `v2.8.7` `v2.8.6` `v2.8.5` `v2.8.4` `v2.8.3` `v2.8.2` `v2.8.1` `v2.8.0` `v2.7.2` `v2.7.1` `v2.7.0` `v2.6.6` `v2.6.5` `v2.6.4` `v2.6.3` `v2.6.2` `v2.6.1` `v2.6.0` `v2.5.0` `v2.4.1` `v2.4.0` `v2.3.2` `v2.3.1` `v2.3.0` `v2.2.4` `v2.2.3` `v2.2.2` `v2.2.1` `v2.2.0` `v2.1.4` `v2.1.3` `v2.1.2` `v2.1.1` `v2.1.0` `v2.0.5` `v2.0.4` `v2.0.3` `v2.0.2` `v2.0.1` `v2.0.0` `v1.0.3` `v1.0.2` `v1.0.1` `v1.0.0` `v1.0.0beta1`

Description

guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session identifiers and authorization tokens when the same cookie jar is reused across trust boundaries.

CVE-2026-67355

Affected versions

Repository

Description

References