CVE-2026-69245 guzzle CVE debrief

Who should care

Defenders and developers using Guzzle for HTTP requests, especially in applications handling sensitive session data, should assess exposure and take immediate action to update to fixed versions.

Why it matters

This vulnerability in Guzzle allows sensitive information disclosure due to improper handling of cookie domains. Defenders should prioritize assessing exposure in applications using Guzzle for HTTP requests, especially those handling sensitive session data, and update to fixed versions 7.15.2 or 8.0.1.

• Session identifier or token disclosure to unintended hosts
• Potential for unauthorized access to sensitive application state
• Need for verification of affected Guzzle versions in use
• Priority for updating to fixed Guzzle versions

Technical summary

The SetCookie::matchesDomain() method in Guzzle incorrectly handles certain domain spellings, potentially leading to sensitive information disclosure. This issue is fixed in Guzzle versions 7.15.2 and 8.0.1. A vulnerability in Guzzle, an extensible PHP HTTP client, allows sensitive information disclosure due to improper handling of cookie domains. The issue arises from the SetCookie::matchesDomain() method, which incorrectly matches subdomains for certain domain spellings, potentially leading to session identifier or token disclosure to unintended hosts. Defenders should prioritize assessing exposure in applications using Guzzle for HTTP requests, especially those handling sensitive session data. Immediate to

Defensive priority

Defenders should prioritize assessing exposure in applications using Guzzle for HTTP requests, especially those handling sensitive session data. Immediate action is required to update to fixed versions 7.15.2 or 8.0.1.

Recommended defensive actions

• Assess exposure in applications using Guzzle for HTTP requests
• Update to Guzzle version 7.15.2 or 8.0.1
• Review and adjust cookie handling in applications using vulnerable Guzzle versions
• Monitor for potential session identifier or token disclosure
• Perform vulnerability scanning to identify exposed assets
• Implement additional logging and monitoring for sensitive data access
• Review and update incident response plans to address potential exploitation

Evidence notes

The vulnerability is confirmed in Guzzle versions prior to 7.15.2 and 8.0.1. Official fixes are available in these versions. Evidence is based on official CVE and NVD records, as well as source references from the Guzzle repository.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.