AIKIDO-2026-254447
guzzlehttp/guzzle is vulnerable to Origin Validation Error
58
Medium Risk
This Affects:
guzzlehttp/guzzleTL;DR
A flaw in guzzle's CookieJar allows cookies with dot-only Domain attributes (e.g., Domain=., Domain=.., Domain= . ) to bypass validation — the leading-dot stripping in matchesDomain() normalizes these to an empty string, which validate() fails to reject, causing the cookie to match any request host. Applications sharing a single CookieJar across attacker-controlled and trusted origins are at risk of cookie injection or session fixation against downstream services.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
guzzlehttp/guzzle is vulnerable to Origin Validation Error in versions 1.0.3 - 7.12.0.
How to fix this
Upgrade the guzzlehttp/guzzle library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant