Packagist/guzzlehttp/guzzle CVE-2026-59883: medium 4.7, EPSS 0.17%

Guzzle: Cookie Disclosure and Injection via IP-Address Domains

Action: Upgrade guzzlehttp/guzzle to 7.12.3 or later.

composer require guzzlehttp/guzzle:7.12.3

Affected

Fixed versions

Sources

• osv: GHSA-g446-98w2-8p5w
• https://github.com/guzzle/guzzle/security/advisories/GHSA-g446-98w2-8p5w
• https://nvd.nist.gov/vuln/detail/CVE-2026-59883
• https://github.com/guzzle/guzzle/pull/3694
• https://github.com/guzzle/guzzle/commit/b9944c161b12d9ee9c9334cfc5b9659ecd7451f8
• https://github.com/guzzle/guzzle
• https://github.com/guzzle/guzzle/releases/tag/7.12.3

CVE-2026-59883 · published 2026-07-20T22:00:09Z · modified 2026-09-10T03:50:51.915343345Z · JSON