CVE-2026-69245 guzzle CVE debrief

Who should care

PHP developers and administrators using Guzzle for HTTP requests, especially those handling sensitive information or user sessions, should be aware of this vulnerability. They need to verify if their Guzzle versions are affected, understand the potential impact on their applications, and take necessary remediation steps. This includes upgrading to secure versions of Guzzle, reviewing application configurations, and monitoring for potential exploits.

Why it matters

CVE-2026-69245 allows sensitive information disclosure in Guzzle due to improper cookie domain handling. Defenders should verify affected versions, upgrade to fixed versions, and monitor for suspicious activity.

• Session identifier or token disclosure to unintended hosts
• Potential for unauthorized access to sensitive information
• Need for verification of affected Guzzle versions and remediation

Technical summary

The SetCookie::matchesDomain() method in Guzzle incorrectly handles cookie domains, allowing sensitive information disclosure to unintended hosts. This issue arises from the method's failure to recognize certain IP literals or numeric hosts, leading to improper granting of access to subdomains. The vulnerability is fixed in Guzzle versions 7.15.2 and 8.0.1, where the handling of cookie domains has been corrected to prevent such disclosures. Affected applications should be reviewed and updated to use secure cookie handling practices.

Defensive priority

Medium

Recommended defensive actions

• Upgrade Guzzle to version 7.15.2 or 8.0.1
• Review and update affected applications to use secure cookie handling
• Monitor for suspicious activity related to cookie disclosure
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed in Guzzle versions prior to 7.15.2 and 8.0.1. Official fixes are available in these versions. Evidence is based on official CVE and NVD records, as well as source references from the Guzzle GitHub repository. Defenders should verify affected versions, review source code for specific exposures, and monitor for suspicious activity related to cookie disclosure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.