CVE-2026-59883: 
PHP vulnerability analysis and mitigation

CVE-2026-59883 is a cookie disclosure and injection vulnerability in Guzzle (guzzlehttp/guzzle), an extensible PHP HTTP client. The flaw exists in all versions prior to 7.12.3, where CookieJar fails to restrict cookies scoped to IP-address or bare-numeric Domain values to the exact host that set them, enabling cross-host cookie disclosure, cookie injection, or session fixation. It was discovered and reported by GrahamCampbell, with the fix merged on June 23, 2026, and published to the GitHub Advisory Database on July 20, 2026. The CVSS v3.1 base score is 4.7 (Moderate) per the GitHub Advisory, though NVD assigns 6.1 (Medium) (Github Advisory, Guzzle Advisory).

The root cause is an origin validation error (CWE-346) in SetCookie::matchesDomain(), which applies ordinary subdomain suffix matching to cookie Domain attributes that are IPv4 literals (e.g., 192.168.0.1), bracketed IPv6 literals (e.g., [::1]), or bare numeric values (e.g., 1). The IP-address check within matchesDomain() is applied only to the request host, never to the cookie's own domain, so response cookies with an explicit IP-address Domain attribute are stored as suffix-matchable. This means Guzzle would send a Domain=192.168.0.1 cookie to evil.192.168.0.1, or a Domain=1 cookie to evil.1, violating RFC 6265 which mandates exact-host matching for IP-address cookie domains. The fix introduces a new isIpAddressOrNumericHost() helper in src/Cookie/SetCookie.php that enforces exact-match-only semantics for such domains (Guzzle Advisory, Patch Commit).

Successful exploitation can result in cross-host cookie disclosure (leaking session tokens or credentials to attacker-controlled hosts), cookie injection (allowing an attacker to plant cookies that are then sent to the legitimate IP-address host), or session fixation (CWE-384, CWE-200). The vulnerability is scoped to applications that use Guzzle's cookie support (e.g., new Client(['cookies' => true])), reuse a single CookieJar across multiple hosts or trust boundaries, and hold cookies scoped to IP-address or bare-numeric hosts. Availability is not impacted, but confidentiality and integrity are both partially affected, with the scope change indicating that resources beyond the vulnerable component can be affected (Github Advisory).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-59883. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as non-automatable, reflecting the requirement for user interaction and attacker influence over name resolution. The EPSS score is approximately 0.115% (2nd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is realistic primarily on private, split-horizon, container, or development networks where an attacker can influence DNS or name resolution to create look-alike hostnames (Github Advisory, Guzzle Advisory).

1. Identify a vulnerable target: Locate a PHP application using Guzzle versions prior to 7.12.3 with cookie support enabled (new Client(['cookies' => true]) or an explicit CookieJar) that communicates with hosts identified by IP addresses or bare numeric values.
2. Gain name resolution influence: On a private, container, split-horizon, or development network, configure a DNS or hosts entry so that a look-alike hostname (e.g., evil.192.168.0.1) resolves to an attacker-controlled server.
3. Trigger cookie storage: Cause the vulnerable Guzzle client to make a request to the legitimate IP-address host (e.g., http://192.168.0.1/) that responds with a Set-Cookie header scoped to that IP (e.g., Set-Cookie: sid=secret; Domain=192.168.0.1; Path=/).
4. Redirect to look-alike host: Cause the application to make a subsequent request to the look-alike host (e.g., http://evil.192.168.0.1/). Due to the suffix-matching flaw, Guzzle will include the sid=secret cookie in this request.
5. Harvest or inject cookies: The attacker-controlled server receives the disclosed cookie (session fixation or credential theft), or alternatively, the attacker's server sets a cookie with Domain=192.168.0.1 that Guzzle then sends to the legitimate IP-address host on future requests (cookie injection) (Guzzle Advisory, Github Advisory).

• Network: Outbound HTTP requests from the application server to unexpected hostnames that are suffixes of internal IP addresses (e.g., evil.192.168.0.1, evil.1); Cookie headers containing session tokens appearing in requests to unintended hosts.
• Logs: Application or web server access logs showing Cookie headers sent to hosts other than the originating IP-address host; DNS queries for look-alike hostnames ending in IP-address labels from the application server.
• Application Behavior: Unexpected session behavior such as session fixation symptoms (users authenticated with attacker-supplied session IDs); cookie values appearing in responses from unrelated hosts.

Upgrade to Guzzle version 7.12.3 or later, which enforces exact-match-only semantics for IPv4 literals, bracketed IPv6 literals, and bare-numeric cookie domains (Guzzle Release). If an immediate upgrade is not possible, avoid reusing a single CookieJar instance across untrusted and trusted origins — use a separate cookie jar per host or trust boundary. Additionally, disable cookie handling for requests to untrusted hosts and avoid using new Client(['cookies' => true]) for clients that may contact multiple hosts at different trust levels (Guzzle Advisory).