This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-59883 →
DEBIAN-CVE-2026-59883
Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain values to the...
Original description
The description as published by the source.
Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain values to the exact host that set them, because SetCookie::matchesDomain() applied ordinary suffix matching to domains such as 192.168.0.1, [::1], or 1, allowing cross-host cookie disclosure, cookie injection, or session fixation. This issue is fixed in version 7.12.3.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
guzzle
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
guzzle
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
guzzle
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.12.3-1"}]}]
References
- advisory security-tracker.debian.org