CVE-2026-67355
Description
A flaw was found in guzzlehttp/guzzle. The software does not correctly enforce the "host-only" scope for cookies, which means it stores the request host in the cookie's domain field instead of restricting the cookie to the exact host. This vulnerability could allow an attacker who controls a subdomain (a "child host") to access cookies intended only for the main domain (the "parent host"). Consequently, sensitive information such as user session identifiers or authorization tokens might be disclosed if the same cookie storage is used across different security boundaries.
Statement
No Red Hat products ship guzzlehttp/guzzle. Community builds of nextcloud and roundcubemail in Fedora and EPEL ship patched versions (7.15.2 and 7.15.3 respectively, fix version is 7.15.1).
Mitigation
Upgrade guzzlehttp/guzzle to version 7.15.1 or later.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
