---
id: CVE-2026-59883
title: Guzzle is an extensible PHP HTTP client
summary: >-
  Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not
  restrict cookies scoped to IP-address or bare-numeric Domain values to the
  exact host that set them, because SetCookie::matchesDomain() applied ordinary
  suffix m…
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-346
  - CWE-384
vendor: guzzlephp
product: guzzle
affected:
  - guzzle < 7.12.3
patched:
  - guzzle 7.12.3
published: '2026-07-08'
updated: '2026-07-13'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59883'
references:
  - url: >-
      https://github.com/guzzle/guzzle/commit/b9944c161b12d9ee9c9334cfc5b9659ecd7451f8
    label: security-advisories@github.com
  - url: 'https://github.com/guzzle/guzzle/pull/3694'
    label: security-advisories@github.com
  - url: 'https://github.com/guzzle/guzzle/releases/tag/7.12.3'
    label: security-advisories@github.com
  - url: 'https://github.com/guzzle/guzzle/security/advisories/GHSA-g446-98w2-8p5w'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00167
epssPercentile: 0.06406
ingestedAt: '2026-07-13T14:27:26.837Z'
---

## Overview

Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain values to the exact host that set them, because SetCookie::matchesDomain() applied ordinary suffix matching to domains such as 192.168.0.1, [::1], or 1, allowing cross-host cookie disclosure, cookie injection, or session fixation. This issue is fixed in version 7.12.3.

## Affected

- `guzzle < 7.12.3`

## Remediation

Upgrade past the affected range:

- `guzzle 7.12.3`