CVE-2026-67355 guzzle CVE debrief

Who should care

Organizations using guzzlehttp/guzzle versions before 7.15.1 should be aware of the host-only cookie scope preservation issue. This affects operators who manage systems using guzzlehttp/guzzle, platform administrators responsible for ensuring secure configurations, vulnerability management teams who need to prioritize and track this issue, and security teams that need to assess the potential impact on their environments and implement necessary mitigations.

Technical summary

guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. This can potentially disclose session identifiers and authorization tokens when the same cookie jar is reused across trust boundaries, especially in scenarios where attackers control child hosts. The vulnerability has a CVSS score of 8.2 and is considered HIGH severity. Organizations using guzzlehttp/guzzle versions before 7.15.1 should prioritize upgrading to 7.15.1 or later to address the host-only cookie scope preservation issue. Reviewing and updating cookie handling configurations, monitoring for potential cookie-related issues, and confirming whether affected product deployments exist in managed environments are also recommended.

Defensive priority

Organizations using guzzlehttp/guzzle versions before 7.15.1 should prioritize upgrading to 7.15.1 or later to address the host-only cookie scope preservation issue.

Recommended defensive actions

• Upgrade to guzzlehttp/guzzle version 7.15.1 or later
• Review and update cookie handling configurations
• Monitor for potential cookie-related issues
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE description indicates that guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope. Limited evidence is available from the source corpus. Further verification is recommended by defenders to understand affected scope, potential impact, and necessary mitigations. This may involve reviewing official advisories, checking system configurations, and monitoring for potential cookie-related issues.

Official resources