https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Tue, 04 Aug 2026 20:37:38 +0000 https://vulnerability.circl.lu/sighting/8e17d5a7-48e5-484b-99f4-6236f721c076/export {"uuid": "8e17d5a7-48e5-484b-99f4-6236f721c076", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69245", "type": "seen", "source": "https://gist.github.com/alon710/4e720b413fb9ae4a89b2607de953bdbe", "content": "# CVE-2026-69245: CVE-2026-69245: Noncanonical Cookie Domain Keeps Subdomain Scope in Guzzle\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69245\n\n## Summary\nA vulnerability in the Guzzle HTTP client allows session identifiers, auth tokens, or cookies to be leaked to unauthorized hosts due to incorrect cookie domain validation of noncanonical IPv4 host formats. Guzzle failed to recognize octal, hexadecimal, and percent-encoded IP addresses as IP literals, treating them as standard domains and incorrectly extending their scope to subdomains.\n\n## TL;DR\nGuzzle's cookie matching logic failed to identify noncanonical IPv4 host formats (like hexadecimal, octal, or percent-encoded) as IP literals, incorrectly applying standard suffix/subdomain matching and leaking sensitive cookies to attacker-controlled subdomains.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-180, CWE-346, CWE-384\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: Low (AC:L)\n- **CVSS Severity**: 6.5 Medium\n- **EPSS Score**: Not Available\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Guzzle (PHP HTTP Client)\n- **Guzzle**: < 7.15.2 (Fixed in: `7.15.2`)\n- **Guzzle**: >= 8.0.0, < 8.0.1 (Fixed in: `8.0.1`)\n\n## Mitigation\n\n- Upgrade Guzzle to version 7.15.2 or 8.0.1 and above.\n- Strictly validate and canonicalize input IP addresses using filter_var() before passing them to the HTTP client.\n- Implement WAF or proxy rules to detect and block noncanonical IP host formats (hexadecimal, octal, percent-encoded) in outbound requests.\n\n**Remediation Steps:**\n1. Identify all Guzzle installations within the dependency tree (composer.lock).\n2. Run 'composer update guzzlehttp/guzzle' to fetch the latest patched version.\n3. Verify the installed version is either >= 7.15.2 or >= 8.0.1.\n\n## References\n\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-69245)\n- [GitHub Security Advisory](https://github.com/guzzle/guzzle/security/advisories/GHSA-f7vp-7xgx-4w4r)\n- [Guzzle 8.0.1 Patch Commit](https://github.com/guzzle/guzzle/commit/3aeea0406aab88cbbd86531313d7cebf8ae149a4)\n- [Guzzle 7.15.2 Patch Commit](https://github.com/guzzle/guzzle/commit/744101956d78b7c1384d0cbf379db13e859167bf)\n- [PR #3907 (7.15 Fixes)](https://github.com/guzzle/guzzle/pull/3907)\n- [PR #3908 (8.0 Fixes)](https://github.com/guzzle/guzzle/pull/3908)\n- [Guzzle 7.15.2 Release Notes](https://github.com/guzzle/guzzle/releases/tag/7.15.2)\n- [Guzzle 8.0.1 Release Notes](https://github.com/guzzle/guzzle/releases/tag/8.0.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69245) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T02:31:55.501348Z"} {"uuid": "8e17d5a7-48e5-484b-99f4-6236f721c076", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69245", "type": "seen", "source": "https://gist.github.com/alon710/4e720b413fb9ae4a89b2607de953bdbe", "content": "# CVE-2026-69245: CVE-2026-69245: Noncanonical Cookie Domain Keeps Subdomain Scope in Guzzle\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69245\n\n## Summary\nA vulnerability in the Guzzle HTTP client allows session identifiers, auth tokens, or cookies to be leaked to unauthorized hosts due to incorrect cookie domain validation of noncanonical IPv4 host formats. Guzzle failed to recognize octal, hexadecimal, and percent-encoded IP addresses as IP literals, treating them as standard domains and incorrectly extending their scope to subdomains.\n\n## TL;DR\nGuzzle's cookie matching logic failed to identify noncanonical IPv4 host formats (like hexadecimal, octal, or percent-encoded) as IP literals, incorrectly applying standard suffix/subdomain matching and leaking sensitive cookies to attacker-controlled subdomains.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-180, CWE-346, CWE-384\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: Low (AC:L)\n- **CVSS Severity**: 6.5 Medium\n- **EPSS Score**: Not Available\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Guzzle (PHP HTTP Client)\n- **Guzzle**: < 7.15.2 (Fixed in: `7.15.2`)\n- **Guzzle**: >= 8.0.0, < 8.0.1 (Fixed in: `8.0.1`)\n\n## Mitigation\n\n- Upgrade Guzzle to version 7.15.2 or 8.0.1 and above.\n- Strictly validate and canonicalize input IP addresses using filter_var() before passing them to the HTTP client.\n- Implement WAF or proxy rules to detect and block noncanonical IP host formats (hexadecimal, octal, percent-encoded) in outbound requests.\n\n**Remediation Steps:**\n1. Identify all Guzzle installations within the dependency tree (composer.lock).\n2. Run 'composer update guzzlehttp/guzzle' to fetch the latest patched version.\n3. Verify the installed version is either >= 7.15.2 or >= 8.0.1.\n\n## References\n\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-69245)\n- [GitHub Security Advisory](https://github.com/guzzle/guzzle/security/advisories/GHSA-f7vp-7xgx-4w4r)\n- [Guzzle 8.0.1 Patch Commit](https://github.com/guzzle/guzzle/commit/3aeea0406aab88cbbd86531313d7cebf8ae149a4)\n- [Guzzle 7.15.2 Patch Commit](https://github.com/guzzle/guzzle/commit/744101956d78b7c1384d0cbf379db13e859167bf)\n- [PR #3907 (7.15 Fixes)](https://github.com/guzzle/guzzle/pull/3907)\n- [PR #3908 (8.0 Fixes)](https://github.com/guzzle/guzzle/pull/3908)\n- [Guzzle 7.15.2 Release Notes](https://github.com/guzzle/guzzle/releases/tag/7.15.2)\n- [Guzzle 8.0.1 Release Notes](https://github.com/guzzle/guzzle/releases/tag/8.0.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69245) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T02:31:55.501348Z"} https://vulnerability.circl.lu/sighting/8e17d5a7-48e5-484b-99f4-6236f721c076/export Tue, 04 Aug 2026 02:31:55 +0000