CVE-2026-69245: 
PHP vulnerability analysis and mitigation

CVE-2026-69245 is a cookie domain scope bypass vulnerability in Guzzle (guzzlehttp/guzzle), a popular PHP HTTP client library. The flaw exists in SetCookie::matchesDomain(), which fails to recognize noncanonical IP address spellings — including hexadecimal forms (e.g., 0x7f000001), mixed-base forms (e.g., 0177.0.0.0x1), and percent-escaped hosts (e.g., 192.168.0.%31) — as numeric hosts, causing cookies scoped to such domains to be incorrectly shared with subdomains. Affected versions are all releases prior to 7.15.2 and version 8.0.0 (fixed in 8.0.1). It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause is an incorrect validation order (CWE-180: Validate Before Canonicalize) combined with an origin validation error (CWE-346) and potential session fixation (CWE-384). SetCookie::matchesDomain() determines whether a cookie domain is an IP literal or numeric host based solely on the domain's literal text, without first canonicalizing it. Because libcurl decodes percent-escapes and resolves hexadecimal/octal IP forms before connecting, a mismatch arises: Guzzle treats 0x7f000001 or 127.0.0.%31 as registered names eligible for subdomain matching, while the underlying transport resolves them as 127.0.0.1. This allows a cookie set for Domain=0x7f000001 to be sent to evil.0x7f000001, and a response from that host setting the same domain to be accepted into the cookie jar. The vulnerability is a partial continuation of GHSA-g446-98w2-8p5w (CVE-2026-59883), which addressed decimal/octal forms but left hexadecimal and percent-escaped variants open (GitHub Advisory, PR #3907).

Successful exploitation can lead to session token or cookie disclosure to unintended hosts, as well as session fixation — where a malicious server answering for a look-alike hostname can inject cookies into the jar that are subsequently replayed to the legitimate address. Confidentiality and integrity are both affected (low impact each), while availability is not impacted. Exploitation is constrained to private, split-horizon, or container DNS zones, since no public DNS delegation provides names ending in hexadecimal or percent-escaped IP spellings; applications using separate cookie jars per host or addressing origins only by canonical dotted-decimal form are not affected (GitHub Advisory).

1. Identify a target application: Find a PHP application using Guzzle with cookie support enabled (cookies option set to a CookieJar instance) that addresses an internal or private origin using a noncanonical IP spelling such as http://0x7f000001/api or http://127.0.0.%31/api.
2. Control a look-alike hostname: In a private, split-horizon, or container DNS zone, register or control a hostname that ends in the noncanonical spelling, e.g., evil.0x7f000001.
3. Trigger cookie disclosure: Cause the target application to make a request to evil.0x7f000001. Because Guzzle's matchesDomain() treats 0x7f000001 as a registered name eligible for subdomain matching, it will include cookies scoped to Domain=0x7f000001 in the Cookie header of the request to evil.0x7f000001, disclosing session identifiers or tokens.
4. Perform session fixation (optional): From the controlled host evil.0x7f000001, respond with a Set-Cookie header setting Domain=0x7f000001. Guzzle accepts this into the cookie jar, and the injected cookie is subsequently replayed to the legitimate address 0x7f000001 (i.e., 127.0.0.1), allowing the attacker to fix application state or hijack a session (GitHub Advisory, PR #3907).

• Network: Outbound HTTP requests from the application server to hostnames ending in hexadecimal IP forms (e.g., evil.0x7f000001) or percent-escaped IP forms (e.g., evil.127.0.0.%31); Cookie headers containing session tokens in requests to such hosts.
• Logs: Application or web server logs showing requests to or from hostnames with hexadecimal, octal, or percent-escaped IP-like patterns in the host field; unexpected Set-Cookie response headers with Domain values containing 0x, octal prefixes, or %-encoded characters.
• File System: No specific file artifacts expected; the attack operates entirely at the HTTP/cookie layer.
• Process: No unusual process behavior expected; exploitation is passive and occurs within normal Guzzle HTTP client operation.

Upgrade to Guzzle 7.15.2 or 8.0.1, which enforce exact-match-only cookie domain scoping for any domain containing a % byte or whose parts are all numeric (decimal, octal, or hexadecimal). As a workaround if upgrading is not immediately possible: do not share a single CookieJar between an origin addressed by a numeric or percent-escaped spelling and any other host ending in that spelling; use a separate jar per host or trust boundary; or address such origins only by their canonical dotted-decimal form (e.g., 127.0.0.1 instead of 0x7f000001). Additionally, rejecting request URI hosts containing percent escapes before passing them to Guzzle closes the percent-escaped vector (GitHub Advisory, PR #3907, PR #3908).

The advisory was published by GrahamCampbell (Guzzle maintainer) on July 26, 2026, with patches released simultaneously for both the 7.15 and 8.0 branches. The fix was noted to complete the remediation begun in GHSA-g446-98w2-8p5w (CVE-2026-59883), which had addressed decimal and octal IP forms but left hexadecimal and percent-escaped variants open. No significant broader media coverage or notable community controversy has been identified beyond the GitHub advisory and associated pull requests (GitHub Advisory, PR #3907).