CVE-2026-59883
Description
A flaw was found in Guzzle, an extensible PHP HTTP client. The CookieJar component improperly handled cookies for IP-address or bare-numeric domains, failing to restrict them to the exact host. This vulnerability could allow a remote attacker to disclose cookies across different hosts, inject malicious cookies, or fixate user sessions, potentially leading to unauthorized access or session hijacking.
Statement
Red Hat's products are not affected by this flaw because the guzzlehttp/guzzle PHP library is not shipped in any Red Hat product.
Mitigation
Use a separate CookieJar instance per host or trust boundary. Do not store cookies scoped to IP-address or bare-numeric domains in a shared jar.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data
Without appropriate protection mechanisms, the client can easily tamper with cookies and similar web data. Reliance on the cookies without detailed validation can lead to problems such as SQL injection. If you use cookie values for security related decisions on the server side, manipulating the cookies might lead to violations of security policies such as authentication bypassing, user impersonation and privilege escalation. In addition, storing sensitive data in the cookie without appropriate protection can also lead to disclosure of sensitive user data, especially data stored in persistent cookies.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
