CVE-2026-67355: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-67355 is a host-only cookie scope bypass vulnerability in the guzzlehttp/guzzle PHP HTTP client library affecting all versions before 7.15.1. The flaw causes CookieJar to store the request host in the cookie's Domain field rather than marking the cookie as host-only, allowing cookies intended exclusively for a parent host to be sent to child subdomains. It was published on August 1, 2026, with the patch released in version 7.15.1. The vulnerability carries a CVSS v3.1 score of 5.9 (Medium) and a CVSS v4.0 score of 8.2 (High) (GitHub Advisory, Github Advisory DB).

The root cause is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data) and CWE-941 (Incorrectly Specified Destination in a Communication Channel). When a server sets a cookie without a Domain attribute (or with an empty one), RFC standards require it to be treated as host-only and returned only to the exact originating host. Guzzle's CookieJar instead populates the Domain field with the request host and applies standard domain-matching logic, effectively widening the cookie's scope to all subdomains. This flaw also affects FileCookieJar and SessionCookieJar, which persist the request host without recording the host-only state, meaning the widened scope survives jar serialization and reload. Exploitation requires the application to use Guzzle's built-in cookie support, reuse the same cookie jar across a parent host and a less-trusted child host, and receive a host-only cookie from the parent (GitHub Advisory).

Successful exploitation allows an attacker who controls or can observe a child subdomain to receive host-only cookies — including session identifiers and authorization tokens — that were intended solely for the parent host. The confidentiality impact is high, as sensitive authentication material can be disclosed across trust boundaries. Integrity and availability are not directly impacted. Applications that do not use Guzzle's cookie support, use a separate jar per host or trust boundary, or only handle cookies with an explicit non-empty Domain attribute are not affected (GitHub Advisory, Github Advisory DB).

1. Identify a target application: Locate a PHP application using guzzlehttp/guzzle (version < 7.15.1) with cookie support enabled (e.g., new Client(['cookies' => true])) that makes requests to both a parent host (e.g., example.com) and a child subdomain (e.g., child.example.com) using the same CookieJar instance.
2. Control or observe a child host: Gain control of or the ability to observe HTTP traffic on a child subdomain of the target parent host (e.g., child.example.com) — for example, through a subdomain takeover, a compromised service, or a man-in-the-middle position on that subdomain.
3. Trigger a request to the parent host: Cause the vulnerable Guzzle client to make a request to the parent host (example.com) that results in the server setting a host-only cookie (i.e., a Set-Cookie header without a Domain attribute, such as Set-Cookie: sid=secret; Path=/; Secure).
4. Observe cookie jar widening: Due to the bug, Guzzle stores Domain=example.com in the cookie record and applies standard domain-matching, making the cookie eligible for delivery to child.example.com.
5. Receive the leaked cookie: When the application subsequently makes a request to child.example.com using the same jar, Guzzle incorrectly includes the sid=secret cookie in the request. As the attacker controls or observes child.example.com, they can capture the cookie value from the incoming HTTP request headers.
6. Exploit the stolen credential: Use the captured session identifier or authorization token to impersonate the user or gain unauthorized access to the parent host's application (GitHub Advisory).

• Network: Unexpected HTTP requests from the Guzzle-based application to child subdomains (e.g., child.example.com) carrying session cookies originally set by the parent host; outbound requests to subdomains not normally contacted by the application.
• Logs: Application or web server logs showing the same session cookie value (sid, auth_token, etc.) appearing in requests to both the parent host and child subdomains; authentication events on the parent host using a session token that was also observed in requests to a child subdomain.
• File System: For applications using FileCookieJar, cookie storage files containing cookie records with a Domain field matching the parent host but lacking a HostOnly boolean marker (indicating records written by a vulnerable version of Guzzle).

Upgrade guzzlehttp/guzzle to version 7.15.1 or later, which correctly records the host-only flag and restricts matching to the exact originating host. After upgrading, delete or rotate any existing FileCookieJar or SessionCookieJar data written by older versions, as those records lack the HostOnly marker and will be rejected (throwing a RuntimeException) by the patched library. If immediate patching is not possible, use a separate CookieJar instance for each host or trust boundary, disable cookie handling for requests to less-trusted subdomains, or avoid using new Client(['cookies' => true]) for clients that contact both parent and child hosts (GitHub Advisory).

The advisory was authored and published by GrahamCampbell, a prominent Guzzle maintainer, on July 18, 2026 via the official GitHub Security Advisory (GHSA-wm3w-8rrp-j577), with the CVE assigned and published on August 1, 2026. No significant broader media coverage or notable social media discussion has been identified at this time (GitHub Advisory).