CVE-2026-59883
Description
A flaw was found in Guzzle, an extensible PHP HTTP client. The CookieJar component improperly handled cookies for IP-address or bare-numeric domains, failing to restrict them to the exact host. This vulnerability could allow a remote attacker to disclose cookies across different hosts, inject malicious cookies, or fixate user sessions, potentially leading to unauthorized access or session hijacking.
Statement
Red Hat's products are not affected by this flaw because the guzzlehttp/guzzle PHP library is not shipped in any Red Hat product.
Mitigation
Use a separate CookieJar instance per host or trust boundary. Do not store cookies scoped to IP-address or bare-numeric domains in a shared jar.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
