{"vulnerability": "GHSA-WM3W-8RRP-J577", "sightings": [{"uuid": "91d5f5f3-2155-4702-9e69-e1a4b0dba12f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-WM3W-8RRP-J577", "type": "seen", "source": "https://gist.github.com/alon710/84075b1c42ed77e39cb61a3601f10615", "content": "# GHSA-WM3W-8RRP-J577: GHSA-WM3W-8RRP-J577: Host-Only Cookie Scope Exposure in Guzzle Cookie Jar\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/GHSA-WM3W-8RRP-J577\n\n## Summary\nAn information disclosure vulnerability in guzzlehttp/guzzle allows host-only cookies to be incorrectly matched and sent to subdomains. Because Guzzle failed to track whether cookies were defined without a Domain attribute, it evaluated host-only cookies using standard domain-suffix rules, widening their scope and exposing sensitive session tokens to untrusted subdomains.\n\n## TL;DR\nGuzzle failed to track whether cookies were originally set without a Domain attribute, causing host-only cookies to be incorrectly forwarded to subdomains and potentially exposing sensitive sessions.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability Type**: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5\n- **Exploit Status**: Proof of Concept (PoC) documented\n- **Affected Components**: GuzzleHttp\\Cookie\\CookieJar\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- guzzlehttp/guzzle\n- **guzzlehttp/guzzle**: < 7.15.1 (Fixed in: `7.15.1`)\n\n## Mitigation\n\n- Upgrade the guzzlehttp/guzzle dependency to version 7.15.1 or later.\n- Clear or regenerate legacy stored cookie jar files to avoid RuntimeExceptions caused by the new strict schema validation.\n- Ensure separate CookieJar instances are utilized when communicating with distinct host domains and untrusted subdomains.\n\n**Remediation Steps:**\n1. Run 'composer update guzzlehttp/guzzle' in the project directory to update Guzzle to at least version 7.15.1.\n2. Locate and delete any persistent JSON cookie storage files managed by FileCookieJar or SessionCookieJar to prevent serialization crashes.\n3. Deploy the updated application and monitor error logs for any unhandled RuntimeException instances during cookie jar loading.\n\n## References\n\n- [GitHub Security Advisory GHSA-WM3W-8RRP-J577](https://github.com/advisories/GHSA-WM3W-8RRP-J577)\n- [Guzzle Security Patch Commit](https://github.com/guzzle/guzzle/commit/7b68220d6543f6f80fe62e633361fc9d4ead14d4)\n- [Guzzle Security Pull Request](https://github.com/guzzle/guzzle/pull/3901)\n- [Guzzle Official v7.15.1 Release Changelog](https://github.com/guzzle/guzzle/releases/tag/7.15.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-WM3W-8RRP-J577) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T01:31:18.746935Z"}]}