CVE-2026-55767

Name of the Vulnerable Software and Affected Versions Guzzle versions prior to 7.12.1

Description CookieJar incorrectly accepts cookies with a dot-only Domain attribute (such as Domain=., Domain=.., Domain=...) and whitespace-padded variants. The SetCookie::matchesDomain() function removes leading dots, normalizing dot-only values to an empty string. Because SetCookie::validate() only rejected strictly empty domains, these cookies were stored and the empty normalized domain was treated as matching any request host. An attacker-controlled origin requested by an application using a shared cookie jar can set a cookie that is subsequently sent to unrelated hosts. This can lead to cookie injection or session fixation against downstream services. This issue affects applications using Guzzle's cookie support, such as new Client(['cookies' => true]) or an explicit shared CookieJar, when the same jar is reused across attacker-controlled and trusted origins.

Recommendations Update to version 7.12.1 or later. As a temporary workaround, do not reuse the same CookieJar instance across untrusted and trusted origins. Use separate cookie jars per origin or trust boundary. Disable cookie handling for requests to untrusted hosts. Avoid using new Client(['cookies' => true]) for clients that may contact unrelated hosts with different trust levels.