CVE-2022-29248: Cross-domain cookie leakage in Guzzle

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-05-25 · updated 2026-06-17
Weakness: CWE-200

Description

Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cookie header, allowing a malicious server to set cookies for unrelated domains. The cookie middleware is disabled by default, so most library consumers will not be affected by this issue. Only those who manually add the cookie middleware to the handler stack or construct the client with ['cookies' => true] are affected. Moreover, those who do not use the same Guzzle client to call multiple domains and have disabled redirect forwarding are not affected by this vulnerability. Guzzle versions 6.5.6 and 7.4.3 contain a patch for this issue. As a workaround, turn off the cookie middleware.

Affected products

Debian Linux: 11.0
Drupal: from 9.2.0 before 9.2.20; from 9.3.0 before 9.3.14 — fixed in 9.2.20, 9.3.14
guzzle: before 6.5.6; from 7.0.0 before 7.4.3 — fixed in 6.5.6, 7.4.3
Packagist Guzzlehttp/Guzzle: before 6.5.6; from 7.0.0 before 7.4.3; 4.0.0, 4.0.0-rc.1, 4.0.0-rc.2, 4.0.1, 4.0.2, 4.1.0 (+122) — fixed in 6.5.6, 7.4.3

How to fix

Upgrade to a fixed version: Drupal 9.2.20, 9.3.14; guzzle 6.5.6, 7.4.3; Packagist Guzzlehttp/Guzzle 6.5.6, 7.4.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-29248 or the next vulnerability affects your stack