CVE-2026-67355 — guzzlehttp/guzzle before 7.15.1 Host-only Cookie Scope
guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers…
Published: 2026-08-01 · CVSS: 8.2 · CVSS 4.0
guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session identifiers and authorization tokens when the same cookie jar is reused across trust boundaries.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7