CVE-2026-59883 Guzzle: Cookie Disclosure and Injection via IP-Address Domains
Attackers can disclose or inject cookies across different IP-address hosts due to improper domain matching in the Guzzle PHP HTTP client library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-59883?
CVE-2026-59883 is a medium-severity vulnerability in guzzle, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain values to the exact host that set them, because SetCookie::matchesDomain() applied ordinary suffix matching to domains such as 192.168.0.1, [::1], or 1, allowing cross-host cookie disclosure, cookie injection, or session fixation. This issue is fixed in version 7.12.3.
Which versions are affected by CVE-2026-59883?
2 open source packages ship an affected version, including guzzlehttp/guzzle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
guzzlehttp/guzzle Packagist | All versions | 7.12.3 |
guzzlehttp/guzzle Packagist | All versions | 7.12.3 |
Products include Guzzlephp Guzzle.
How do I fix CVE-2026-59883?
Upgrade guzzlehttp/guzzle to 7.12.3 or later.
Is CVE-2026-59883 being exploited?
There is no known exploitation of CVE-2026-59883 in the wild and no public exploit code.
Other vulnerabilities in guzzle
Sources
Also known as DEBIAN-CVE-2026-59883, GHSA-g446-98w2-8p5w, MINI-6mxm-xrwg-7f3r, MINI-9fhr-8prm-x7q6, MINI-cq5g-g8p8-r42h, MINI-f7pp-9rv3-pwv2 and 6 more.