AIKIDO-2026-254447
guzzlehttp/guzzle is vulnerable to Origin Validation Error
58
Medium Risk
This Affects:
guzzlehttp/guzzleTL;DR
A flaw in guzzle's CookieJar allows cookies with dot-only Domain attributes (e.g., Domain=., Domain=.., Domain= . ) to bypass validation — the leading-dot stripping in matchesDomain() normalizes these to an empty string, which validate() fails to reject, causing the cookie to match any request host. Applications sharing a single CookieJar across attacker-controlled and trusted origins are at risk of cookie injection or session fixation against downstream services.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
guzzlehttp/guzzle is vulnerable to Origin Validation Error in versions 1.0.3 - 7.12.0.
How to fix this
Upgrade the guzzlehttp/guzzle library to the patch version.
Links
GitHub Release
Other
github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#7121---2026-06-18github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2026-55767.yaml
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.