[From nobody Wed Aug 5 06:35:08 2026 Received: (at submit) by bugs.debian.org; 4 Aug 2026 17:39:32 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-9.9 required=4.0 tests=BAYES_00, FOURLA, FROMDEVELOPER, NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 44; hammy, 150; neutral, 157; spammy, 0. spammytokens: hammytokens:0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--H*F:U*carnil, 0.000-+--H*Ad:N*Bug, 0.000-+--HTo:N*Debian Return-path: <carnil@debian.org> Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96) (envelope-from <carnil@debian.org>) id 1wrJ6w-00EwQq-27 for submit@bugs.debian.org; Tue, 04 Aug 2026 17:39:32 +0000 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Salvatore Bonaccorso <carnil@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: guzzle: CVE-2026-69245 CVE-2026-69246 Message-ID: <178586516348.3980335.4758102652362452.reportbug@eldamar.lan> X-Mailer: reportbug 13.2.0+nmu1 Date: Tue, 04 Aug 2026 19:39:23 +0200 Delivered-To: submit@bugs.debian.org Source: guzzle Version: 7.15.1-1 Severity: important Tags: security upstream X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org> Hi, The following vulnerabilities were published for guzzle. CVE-2026-69245[0]: | Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, | SetCookie::matchesDomain() gives every subdomain of a cookie Domain | that cookie unless SetCookie::matchesDomain() recognizes the Domain | as an IP literal or a numeric host, and the decision comes from the | domain's own text, so two spellings a transport reads as an address | keep subdomain scope. Hexadecimal and mixed-base forms such as | 0x7f000001 and 0177.0.0.0x1 go unrecognized while libcurl 8.21.0 | reads both as 127.0.0.1. A percent-escaped Domain keeps that scope | on both branches because percent-decoding sits above numeric | parsing, so 192.168.0.%31 and 127.0.0.1%2e are registered names in | the URI grammar rather than address literals, and no numeric rule in | any base classifies them, while libcurl decodes the host before | resolving and reads them as 192.168.0.1 and 127.0.0.1. A cookie | stored for Domain=0x7f000001 is placed in the Cookie header of a | request to evil.0x7f000001, disclosing a session identifier or token | to a host that is not that address, and a response from | evil.0x7f000001 setting Domain=0x7f000001 is accepted into the jar | and replayed to the address, so a server answering for the look- | alike name can fix a session or set application state. Exploitation | requires the application to enable cookie support, address an origin | by one of these spellings, and contact a host whose name ends in | that spelling. This issue is fixed in versions 7.15.2 and 8.0.1. CVE-2026-69246[1]: | Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, | Guzzle gives a transport the request URI as text and supplies the | Host header separately. The cURL handlers set CURLOPT_URL to the URI | exactly as written and push that Host into CURLOPT_HTTPHEADER; | StreamHandler does the same through fopen(). libcurl then parses the | authority itself, percent-decoding it and, on an IDN-capable build, | applying IDNA mapping, and uses the result to resolve, connect, name | the TLS peer and address a proxy CONNECT, while the supplied Host | suppresses the aligned one libcurl would have generated. For a URI | host written as 127.0.0.%31, filter_var() rejects the host as an IP | literal, yet libcurl decodes it to 127.0.0.1 and reaches loopback | with no DNS lookup while the server receives Host: 127.0.0.%31. An | attacker who influences a fetched URI can therefore reach a host the | application's checks excluded and read whatever the host exposes of | the response. The same divergence moves Guzzle's own decisions onto | a spelling the transport does not use: no_proxy selects proxy | routing from the literal host, and RedirectMiddleware decides from | it whether to strip Authorization and Cookie. Exploitation requires | the application to build a request URI from untrusted input and to | make a host decision before handing it to Guzzle. This issue is | fixed in versions 7.15.2 and 8.0.1. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-69245 https://www.cve.org/CVERecord?id=CVE-2026-69245 [1] https://security-tracker.debian.org/tracker/CVE-2026-69246 https://www.cve.org/CVERecord?id=CVE-2026-69246 Please adjust the affected versions in the BTS as needed. Regards, Salvatore ]