[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
guzzlehttp/guzzle (source)	7.15.1 → 7.15.2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Guzzle: Noncanonical cookie domain keeps subdomain scope

CVE-2026-69245 / GHSA-f7vp-7xgx-4w4r

More information

Details

Impact

SetCookie::matchesDomain() gives every subdomain of a cookie Domain that cookie unless it recognizes the Domain as an IP literal or a numeric host, and it decides that from the domain's own text, so two spellings a transport reads as an address keep subdomain scope. On 7.15, hexadecimal and mixed-base forms such as 0x7f000001 and 0177.0.0.0x1 go unrecognized while libcurl 8.21.0 reads both as 127.0.0.1, so closing them completes the rule GHSA-g446-98w2-8p5w (CVE-2026-59883) set out to establish, which cited the WHATWG IPv4 parser and so already admitted a 0x part. A percent-escaped Domain keeps that scope on both branches for a different reason: percent-decoding sits above numeric parsing, so 192.168.0.%31 and 127.0.0.1%2e are registered names in the URI grammar rather than address literals, and no numeric rule in any base classifies them, while libcurl decodes the host before it resolves and reads them as 192.168.0.1 and 127.0.0.1. The escape must fall in the rightmost label on 8.0.0, which already catches a decimal, octal or 0x part there, but not on 7.15, where %31%32%37.0.0.0x1 also reads as 127.0.0.1; 8.0.0 is affected in the percent spelling alone.

Both directions of the defect are reproduced over a real socket. A cookie stored for Domain=0x7f000001 is placed in the Cookie header of a request to evil.0x7f000001, disclosing a session identifier or token to a host that is not that address, and a response from evil.0x7f000001 setting Domain=0x7f000001 is accepted into the jar and replayed to the address, so a server answering for the look-alike name can fix a session or set application state.

Exploitation requires the application to enable cookie support, address an origin by one of these spellings, and contact a host whose name ends in it. No public DNS delegation provides such a name, so the exposure is to private, split-horizon and container zones. Applications that do not use Guzzle's cookies, that keep a separate jar for each host or trust boundary, or that address origins only by ordinary names are not affected.

Patches

This is a summary; the patches are the authority. The issue is fixed in 7.15.2 and 8.0.1, which hold a cookie Domain containing a % byte to an exact match against the request host. 7.15.2 additionally holds to an exact match a Domain whose every dot-separated part is decimal, octal or hexadecimal, a rule wide enough that 0x100000000, a name to libcurl, loses subdomain matching too; 8.0.0 already recognizes a 0x-prefixed rightmost label. One class stays open: an IDN-capable transport reads a fullwidth-digit Domain such as 127.0.0.１ as 127.0.0.1 while Guzzle matches it by suffix, and these patches do not close that. Versions before 7.15.2 and version 8.0.0 are affected, 8.0.0 in the percent spelling alone.

Workarounds

If you cannot upgrade, do not share one CookieJar between an origin addressed by a numeric or percent-escaped spelling and any other host ending in that spelling. Use a separate jar for each host or trust boundary, or address such an origin by its canonical dotted-decimal form, writing 127.0.0.1, which released versions already hold to an exact match, rather than 0x7f000001 or 127.0.0.%31. Rejecting a request URI host that contains a percent escape, before you hand the URI to Guzzle and on every redirect hop, closes that spelling, and rejecting a non-ASCII byte closes the fullwidth one, but nothing outside the jar closes the hexadecimal one.

Do not use filter_var() with FILTER_VALIDATE_IP to decide whether a domain is an address: it rejects 0x7f000001 and 127.0.0.%31, which a transport reads as 127.0.0.1.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

• https://github.com/guzzle/guzzle/security/advisories/GHSA-f7vp-7xgx-4w4r
• https://github.com/guzzle/guzzle/pull/3907
• https://github.com/guzzle/guzzle/pull/3908
• https://github.com/guzzle/guzzle/commit/3aeea0406aab88cbbd86531313d7cebf8ae149a4
• https://github.com/guzzle/guzzle/commit/744101956d78b7c1384d0cbf379db13e859167bf
• https://github.com/guzzle/guzzle/releases/tag/7.15.2
• https://github.com/guzzle/guzzle/releases/tag/8.0.1
• https://github.com/advisories/GHSA-f7vp-7xgx-4w4r

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Guzzle: Noncanonical host can bypass host-based checks

CVE-2026-69246 / GHSA-v5mv-p594-2x33

More information

Details

Impact

In affected versions, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPT_URL to the URI exactly as written and push that Host into CURLOPT_HTTPHEADER; StreamHandler does the same through fopen(). libcurl then parses the authority itself, percent-decoding it and, on an IDN-capable build, applying IDNA mapping, and uses the result to resolve, connect, name the TLS peer and address a proxy CONNECT, while the supplied Host suppresses the aligned one it would have generated. In http://127.0.0.%31/ the URI host is one filter_var() rejects as an IP literal, yet libcurl decodes it to 127.0.0.1 and reaches loopback with no DNS lookup while the server receives Host: 127.0.0.%31.

An attacker who influences a fetched URI can therefore reach a host the application's checks excluded and read whatever it exposes of the response. The same divergence moves Guzzle's own decisions onto a spelling the transport does not use: no_proxy selects proxy routing from the literal host, and RedirectMiddleware decides from it whether to strip Authorization and Cookie. The cookie middleware extracts Set-Cookie against the URI Guzzle produced, not the authority contacted, so for a raw divergent URI the cookie is stored under the URI host as written. Where Guzzle rewrote that URI but left a divergent Host, or where the caller supplied one, the cookie is stored under the canonical name and replayed by ordinary later requests to it. With a third-party UriInterface, a host of blocked.example.com@127.0.0.1 reaches 127.0.0.1 through all three handlers and generates Authorization: Basic from userinfo the application never wrote.

Exploitation requires the application to build a request URI from untrusted input and to make a host decision before handing it to Guzzle. Applications that only fetch URIs they construct themselves are not affected, and an exact allowlist of canonical names ordinarily fails closed; the exposure is to denylists, private-range and IP-literal checks, and any check that treats an unresolvable name as safe. The raw Unicode class needs an IDNA transformation somewhere: either a libcurl built with IDN support or Guzzle's own idn_conversion, off by default on both branches, which rewrites the URI in Client::buildUri() before a handler sees it and leaves a prebuilt request's explicit Host as written, while a request the client builds derives that header from the rewritten URI and produces no divergence. Noncanonical numeric spellings such as 127.1, 2130706433, 0x7f000001 and 0177.0.0.1 remain accepted after the patch and reach whatever the transport reads them as, loopback or a routable public host, and the cURL and stream handlers can differ, so a check comparing a host against an address as text stays bypassable. Guzzle does not offer SSRF protection, and neither cache poisoning nor cross-tenant compromise was established.

Patches

This is a summary; the patches are the authority. The issue is fixed in 7.15.2 and 8.0.1, which validate the request host in all three built-in handlers before any network I/O. A URI host is rejected for a byte outside 0x21 to 0x7E, a percent escape, a URI authority delimiter, unbalanced brackets, or numeric-looking parts followed by a trailing dot. That last rule is deliberately conservative and also refuses out-of-range forms libcurl keeps as names, such as 256.0.0.1.. An explicit Host header must be printable ASCII, and on 7.15.2 free of percent escapes. The client also regenerates a derived Host when it rewrites the request URI. Versions before 7.15.2 and version 8.0.0 are affected.

Workarounds

If you cannot upgrade, constrain the host yourself before handing a URI to Guzzle, and constrain any explicit Host header separately, on every redirect hop. The URI rule assumes $uri is a validated GuzzleHttp\Psr7\Uri, so re-parse a third-party UriInterface with new Uri((string) $uri) first.

$host = $uri->getHost();

if (
    preg_match('/\A[\x21-\x7E]*\z/D', $host) !== 1
    || strpbrk($host, '%@/?#\\') !== false
    || substr($host, -1) === '.'
) {
    throw new RuntimeException('Refusing to fetch this URI host.');
}

if (
    preg_match('/\A[\x21-\x7E]*\z/D', $hostHeader) !== 1
    || strpos($hostHeader, '%') !== false
) {
    throw new RuntimeException('Refusing to send this Host header.');
}

It differs from the patch in both directions: it refuses example.com., which the patch accepts, and it does not canonicalize 127.1 or 0x7f000001. Reparsing the URI separates a valid port from the host and rejects malformed bracket forms, so the snippet checks the host component alone. idn_conversion => true is not an access control, since IDNA maps １２７。０。０。１ onto 127.0.0.1 and direct handler use bypasses it, and Uri::getHost() is not an SSRF boundary: it is the host as written, not the host a transport connects to. Where the destination matters, resolve the host and check the addresses, and use a separate cookie jar for untrusted origins.

Severity

• CVSS Score: 7.2 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

References

• https://github.com/guzzle/guzzle/security/advisories/GHSA-v5mv-p594-2x33
• https://github.com/guzzle/guzzle/pull/3907
• https://github.com/guzzle/guzzle/pull/3908
• https://github.com/guzzle/guzzle/commit/3aeea0406aab88cbbd86531313d7cebf8ae149a4
• https://github.com/guzzle/guzzle/commit/744101956d78b7c1384d0cbf379db13e859167bf
• https://github.com/guzzle/guzzle/releases/tag/7.15.2
• https://github.com/guzzle/guzzle/releases/tag/8.0.1
• https://github.com/advisories/GHSA-v5mv-p594-2x33

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

guzzle/guzzle (guzzlehttp/guzzle)

v7.15.2

Compare Source

Security

• Reject non-printable-ASCII and percent-escaped URI hosts and Host headers (GHSA-v5mv-p594-2x33)
• Reject request URI hosts that contain a URI authority delimiter (GHSA-v5mv-p594-2x33)
• Reject numeric-looking URI hosts with trailing dots, read as IPv4 addresses (GHSA-v5mv-p594-2x33)
• Treat numeric-in-any-base and percent-escaped cookie domains as exact-match-only (GHSA-f7vp-7xgx-4w4r)
• Regenerate a derived Host header after client URI rewrites (GHSA-v5mv-p594-2x33)

Fixed

• Preserve RequestException when the stream handler rejects a request before opening a stream

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Issue bot detected changes — view run:

Result of the code snippet from @pereorga in #11889 changed:

@@ @@
 PHP 8.0 – 8.4 (1 error)
 ==========
 
-12: Function get_cv_files() should return list<string> but returns array.
+12: Function get_cv_files() should return list<string> but returns list.
 
 PHP 7.2 – 7.4 (1 error)
 ==========
 
-12: Function get_cv_files() should return list<string> but returns array|false.
+12: Function get_cv_files() should return list<string> but returns list|false.

Full report

PHP 8.0 – 8.4 (1 error)

Line	Error
12	Function get_cv_files() should return list<string> but returns list.

PHP 7.2 – 7.4 (1 error)

Line	Error
12	`Function get_cv_files() should return list but returns list

---

Result of the code snippet from @staabm in #14768 changed:

@@ @@
+7: Expected type decimal-int-string, actual: lowercase-string&numeric-string&uppercase-string
 9: Expected type non-decimal-int-string, actual: string

Full report

Line	Error
7	Expected type decimal-int-string, actual: lowercase-string&numeric-string&uppercase-string
9	Expected type non-decimal-int-string, actual: string

---

Result of the code snippet from @staabm in #14786 changed:

@@ @@
  7: Function doFoo() has no return type specified.
-10: Call to function is_int() with int will always evaluate to true.
+ 7: PHPDoc tag @param for parameter $s contains unresolvable type.
+ 8: Unary operation "+" on string results in an error.

Full report

Line	Error
7	Function doFoo() has no return type specified.
7	PHPDoc tag @param for parameter $s contains unresolvable type.
8	Unary operation "+" on string results in an error.

---

Result of the code snippet from @staabm in #14786 changed:

@@ @@
 7: Function doFoo() has no return type specified.
-9: Expected type (float|int), actual: int
+7: PHPDoc tag @param for parameter $s contains unresolvable type.
+8: Unary operation "+" on string results in an error.
+9: Expected type (float|int), actual: *ERROR*

Full report

Line	Error
7	Function doFoo() has no return type specified.
7	PHPDoc tag @param for parameter $s contains unresolvable type.
8	Unary operation "+" on string results in an error.
9	`Expected type (float

---