Guzzle: Prior to 7.12.1, CookieJar incorrectly accepts cookies with a dot-only Domain attribute and whitespace-padded variants. (CVE-2026-55767)

Guzzle, a PHP HTTP client, had a vulnerability in its CookieJar prior to version 7.12.1. The SetCookie::matchesDomain() method removes leading dots from cookie domains, normalizing dot-only domains to an empty string. However, SetCookie::validate() only rejects strictly empty domains, allowing dot-only or whitespace-padded domain cookies to be stored. Since the empty normalized domain matches any request host, an attacker-controlled origin can set cookies that Guzzle later sends to unrelated hosts using the same cookie jar. This behavior may lead to cookie injection or session fixation against downstream services depending on their cookie handling. The vulnerability is resolved in version 7.12.1.

An attacker controlling an origin that an application requests with a shared cookie jar can set cookies that Guzzle sends to unrelated hosts. This can result in cookie injection or session fixation attacks against downstream services, potentially allowing attackers to manipulate session state or authentication tokens. The vulnerability does not affect confidentiality but impacts integrity of session management.

Upgrade Guzzle to version 7.12.1 or later, where this vulnerability is fixed. No other mitigations are specified or required.