CVE-2026-67355 HIGH

CVE-2026-67355: guzzlehttp/guzzle before 7.15.1 Host-only Cookie Scope

Vendor Guzzle

Product guzzle

Weakness CWE-201

Published August 1, 2026

Last update August 1, 2026

View on NVD All CVEs

CVSS base score

8.2/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session identifiers and authorization tokens when the same cookie jar is reused across trust boundaries.

Key dates

02Disclosure timeline

August 1, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-67355 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/201.html AskarLabs — CWE-201 write-up Insertion of Sensitive Information Into Sent Data

Related vulnerabilities

CVE-2026-67355: guzzlehttp/guzzle before 7.15.1 Host-only Cookie Scope

01Description

02Disclosure timeline

03References

04Related CVE