Read the docs
TI-2022-11789 Aliases CVE-2022-29248GHSA-cwmx-hcrq-mhc3

Cross-domain cookie leakage in Guzzle

Priority MEDIUM 40CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cookie header, allowing a malicious server to set cookies for unrelated domains. The cookie middleware is disabled by default, so most library consumers will not be affected by this issue. Only those who manually add the cookie middleware to the handler stack or construct the client with ['cookies' => true] are affected. Moreover, those who do not use the same Guzzle client to call multiple domains and have disabled redirect forwarding are not affected by this vulnerability. Guzzle versions 6.5.6 and 7.4.3 contain a patch for this issue. As a workaround, turn off the cookie middleware.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01351 71st percentileScored 2026-11-07
Fix Fixed guzzle (guzzle): 6.5.6, 7.4.3guzzlehttp/guzzle (Packagist): 6.5.6, 7.4.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
guzzleguzzlebefore 6.5.6; 7.0.0 to before 7.4.36.5.6, 7.4.3Patch availableCNA
—guzzlehttp/guzzle (Packagist)before 6.5.66.5.6Patch availableGHSA-cwmx-hcrq-mhc3
—guzzlehttp/guzzle (Packagist)7.0.0 to before 7.4.37.4.3Patch availableGHSA-cwmx-hcrq-mhc3
  • guzzle Vendorguzzle Affected before 6.5.6; 7.0.0 to before 7.4.3 Fixed in 6.5.6, 7.4.3 Patch available CNA
  • guzzlehttp/guzzle (Packagist) Vendor— Affected before 6.5.6 Fixed in 6.5.6 Patch available GHSA-cwmx-hcrq-mhc3
  • guzzlehttp/guzzle (Packagist) Vendor— Affected 7.0.0 to before 7.4.3 Fixed in 7.4.3 Patch available GHSA-cwmx-hcrq-mhc3

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:guzzlephp:guzzle:*:*:*:*:*:*:*:*before 6.5.6; 7.0.0 to before 7.4.3Vulnerableguzzle
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*9.2.0 to before 9.2.20; 9.3.0 to before 9.3.14VulnerableDrupal
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:guzzlephp:guzzle:*:*:*:*:*:*:*:* Versions before 6.5.6; 7.0.0 to before 7.4.3 Vulnerable ·guzzle
  • cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* Versions 9.2.0 to before 9.2.20; 9.3.0 to before 9.3.14 Vulnerable ·Drupal
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · CNA guzzle (guzzle) Fixed in 6.5.6, 7.4.3
  • Fix · GHSA-cwmx-hcrq-mhc3 guzzlehttp/guzzle (Packagist) Fixed in 6.5.6 Advisory →
  • Fix · GHSA-cwmx-hcrq-mhc3 guzzlehttp/guzzle (Packagist) Fixed in 7.4.3 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-29248
  2. 2026-10-03 Alias added: GHSA-cwmx-hcrq-mhc3

References

Patch 3

Advisory 3

Other 2

  • TI-2022-13088 Fix failure to strip Authorization header on HTTP downgrade in Guzzle CVSS 3.1HIGH 7.5
  • TI-2022-13087 Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle CVSS 3.1HIGH 7.5
  • TI-2022-13135 Change in port should be considered a change in origin in Guzzle CVSS 3.1HIGH 7.7
  • TI-2022-13134 CURLOPT_HTTPAUTH option not cleared on change of origin in Guzzle CVSS 3.1HIGH 7.7
  • TI-2026-40256 Guzzle: Dot-Only Cookie Domains Match All Hosts in guzzlehttp/guzzle CVSS 3.1MEDIUM 5.8
  • TI-2026-42697 Guzzle: Cookie Disclosure and Injection via IP-Address Domains CVSS 3.1MEDIUM 6.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences