Listen to this Post
How CVE-2026-59883 Works
The vulnerability resides in Guzzle’s `SetCookie::matchesDomain()` method, which determines if a cookie should be sent to a given host. Per RFC 6265, a cookie with a `Domain` attribute that is an IP address must only match the exact host that set it and must never match a subdomain.
However, in vulnerable versions, `SetCookie::matchesDomain()` applies ordinary suffix (subdomain) matching to the cookie’s `Domain` value instead of enforcing an exact match. The critical flaw is that the IP-address check is performed only on the request host and never on the cookie’s own domain. This allows a cookie scoped to an IP-address or bare-numeric domain to be sent to any host whose name ends in that value.
For example, a cookie with `Domain=192.168.0.1` would be sent to evil.192.168.0.1. Conversely, a response from a look-alike host like `evil.192.168.0.1` can set a cookie with Domain=192.168.0.1, which Guzzle will then send to the bare IP address, enabling cookie injection or session fixation.
The vulnerability is exacerbated by the parser’s handling of non-canonical IP address spellings. Forms such as `0x7f000001` (hexadecimal) and `127.0.0.%31` (percent-encoded) are not recognized as IP literals by the vulnerable `matchesDomain()` logic. Consequently, they retain subdomain scope, even though the underlying transport (like libcurl) resolves them to a valid IP address like 127.0.0.1. This allows for sophisticated bypasses where a cookie set for `0x7f000001` can be disclosed to evil.0x7f000001.
DailyCVE Form
Platform: Guzzle (PHP HTTP Client)
Version: < 7.12.3
Vulnerability: Cookie Domain Validation Bypass
Severity: Medium (CVSS 4.7)
Date: 2026-07-08
Prediction: 2026-07-26
What Undercode Say: Analytics
The vulnerability is triggered when the following conditions are met:
1. The application uses Guzzle’s cookie support (e.g., new Client(['cookies' => true])).
2. A single `CookieJar` instance is reused across multiple hosts or trust boundaries.
3. The cookie jar contains a cookie scoped to an IP-address or bare-numeric host.
4. The application resolves and connects to a look-alike host whose name ends in that IP-address label.
This exposure is primarily a concern in private, split-horizon, container, or development networks where an attacker can influence name resolution.
The fix involves modifying `SetCookie::matchesDomain()` to require an exact host match for IPv4 literals, bracketed IPv6 literals, and bare-numeric cookie domains.
Exploit
An attacker can exploit this by crafting a malicious hostname that ends with the IP address of a target cookie. For example, if a vulnerable application stores a cookie with Domain=192.168.0.1, an attacker who can control resolution for `evil.192.168.0.1` can receive that cookie in a request.
Conversely, an attacker controlling a server at `evil.192.168.0.1` can set a response cookie with Domain=192.168.0.1. The vulnerable Guzzle client will store this cookie and subsequently send it to the legitimate `192.168.0.1` server, allowing for session fixation or cookie injection.
Protection
- Upgrade: Immediately update to Guzzle version `7.12.3` or later.
- Isolate Cookie Jars: Do not reuse a single `CookieJar` instance across different hosts or trust boundaries. Use a separate jar per host.
- Disable Cookies: Disable cookie handling for requests to untrusted or untrusted hosts.
- Avoid Risky Scopes: Avoid scoping cookies to IP-address or bare-numeric hosts.
- Client Isolation: Avoid using `new Client([‘cookies’ => true])` for any client that may contact unrelated hosts at different trust levels, as this creates a single shared jar.
Impact
- Cross-Host Cookie Disclosure: Session identifiers or tokens can be leaked to unauthorized hosts.
- Cookie Injection: Malicious cookies can be injected into the client’s jar.
- Session Fixation: Attackers can fix a user’s session to a value they control.
- Privilege Escalation: Combined with other techniques, this can lead to unauthorized access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
