cve-2026-67355

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67355.json"
      }
    ],
    "title": "guzzlehttp/guzzle: guzzlehttp/guzzle: Information disclosure from host-only cookie scope issue",
    "tracking": {
      "current_release_date": "2026-08-27T16:27:32+00:00",
      "generator": {
        "date": "2026-08-27T16:27:32+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "CVE-2026-67355",
      "initial_release_date": "2026-08-01T12:22:17.646000+00:00",
      "revision_history": [
        {
          "date": "2026-08-01T12:22:17.646000+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-27T15:45:20+00:00",
          "number": "2",
          "summary": "Current version"
        },
        {
          "date": "2026-08-27T16:27:32+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Red Hat",
        "product": {
          "name": "All currently supported Red Hat products",
          "product_id": "red_hat_products",
          "product_identification_helper": {
            "cpe": "cpe:/a:redhat"
          }
        }
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-67355",
      "discovery_date": "2026-08-01T13:03:18.276310+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "red_hat_products"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in guzzlehttp/guzzle. The software does not correctly enforce the \"host-only\" scope for cookies, which means it stores the request host in the cookie's domain field instead of restricting the cookie to the exact host. This vulnerability could allow an attacker who controls a subdomain (a \"child host\") to access cookies intended only for the main domain (the \"parent host\"). Consequently, sensitive information such as user session identifiers or authorization tokens might be disclosed if the same cookie storage is used across different security boundaries.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "No Red Hat products ship guzzlehttp/guzzle. Community builds of nextcloud and roundcubemail in Fedora and EPEL ship patched versions (7.15.2 and 7.15.3 respectively, fix version is 7.15.1).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "red_hat_products"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67355"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67355"
        },
        {
          "category": "external",
          "summary": "https://github.com/guzzle/guzzle/security/advisories/GHSA-wm3w-8rrp-j577",
          "url": "https://github.com/guzzle/guzzle/security/advisories/GHSA-wm3w-8rrp-j577"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/guzzlehttp-guzzle-before-host-only-cookie-scope",
          "url": "https://www.vulncheck.com/advisories/guzzlehttp-guzzle-before-host-only-cookie-scope"
        }
      ],
      "release_date": "2026-08-01T12:22:17.646000+00:00",
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "red_hat_products"
          ]
        }
      ],
      "title": "guzzlehttp/guzzle: guzzlehttp/guzzle: Information disclosure from host-only cookie scope issue"
    }
  ]
}