{"items":[{"id":"NVI-00007985","kind":"vulnerability","title":"Guzzle: Noncanonical cookie domain keeps subdomain scope","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-f7vp-7xgx-4w4r","CVE-2026-69245"],"plain_summary":"OSV carries this publisher advisory for guzzlehttp/guzzle, guzzlehttp/guzzle. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 7.15.2 for guzzlehttp/guzzle. Confirm the publisher’s latest guidance.","source_ids":["sr-f12dea06d2d820b1e1993c3481a90425"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 8.0.1 for guzzlehttp/guzzle. Confirm the publisher’s latest guidance.","source_ids":["sr-f12dea06d2d820b1e1993c3481a90425"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-18e99538a50038bd1f61bcecb0644e99"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-11-02T12:00:30.000Z","value":"0.199%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.09798. Missing scores are unknown.","source_id":"sr-18e99538a50038bd1f61bcecb0644e99"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-f12dea06d2d820b1e1993c3481a90425","url":"https://github.com/advisories/GHSA-f7vp-7xgx-4w4r","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-f7vp-7xgx-4w4r","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:10.711Z"},{"id":"sr-18e99538a50038bd1f61bcecb0644e99","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-69245","publisher":"FIRST EPSS","observed_at":"2026-11-02T20:15:58.861Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-f12dea06d2d820b1e1993c3481a90425"],"technology":"guzzlehttp/guzzle","known_exclusions":[],"conditions_summary":"### Impact\n\n`SetCookie::matchesDomain()` gives every subdomain of a cookie `Domain` that cookie unless it recognizes the `Domain` as an IP literal or a numeric host, and it decides that from the domain's own text, so two spellings a transport reads as an address keep subdomain scope. On `7.15`, hexadecimal and mixed-base forms such as `0x7f000001` and `0177.0.0.0x1` go unrecognized while libcurl 8.21.0 reads both as `127.0.0.1`, so closing them completes the rule `GHSA-g446-98w2-8p5w` (`CVE-2026-59883`) set out to establish, which cited the WHATWG IPv4 parser and so already admitted a `0x` part. A percent-escaped `Domain` keeps that scope on both branches for a different reason: percent-decoding sits above numeric parsing, so `192.168.0.%31` and `127.0.0.1%2e` are registered names in the URI grammar rather than address literals, and no numeric rule in any base classifies them, while libcurl decodes the host before it resolves and reads them as `192.168.0.1` and `127.0.0.1`. The escape must fall in the rightmost label on `8.0.0`, which already catches a decimal, octal or `0x` part there, but not on `7.15`, where `%31%32%37.0.0.0x1` also reads as `127.0.0.1`; `8.0.0` is affected in t","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 7.15.2"]},{"certainty":"source_listed","source_ids":["sr-f12dea06d2d820b1e1993c3481a90425"],"technology":"guzzlehttp/guzzle","known_exclusions":[],"conditions_summary":"### Impact\n\n`SetCookie::matchesDomain()` gives every subdomain of a cookie `Domain` that cookie unless it recognizes the `Domain` as an IP literal or a numeric host, and it decides that from the domain's own text, so two spellings a transport reads as an address keep subdomain scope. On `7.15`, hexadecimal and mixed-base forms such as `0x7f000001` and `0177.0.0.0x1` go unrecognized while libcurl 8.21.0 reads both as `127.0.0.1`, so closing them completes the rule `GHSA-g446-98w2-8p5w` (`CVE-2026-59883`) set out to establish, which cited the WHATWG IPv4 parser and so already admitted a `0x` part. A percent-escaped `Domain` keeps that scope on both branches for a different reason: percent-decoding sits above numeric parsing, so `192.168.0.%31` and `127.0.0.1%2e` are registered names in the URI grammar rather than address literals, and no numeric rule in any base classifies them, while libcurl decodes the host before it resolves and reads them as `192.168.0.1` and `127.0.0.1`. The escape must fall in the rightmost label on `8.0.0`, which already catches a decimal, octal or `0x` part there, but not on `7.15`, where `%31%32%37.0.0.0x1` also reads as `127.0.0.1`; `8.0.0` is affected in t","public_affected_ranges":["ECOSYSTEM: introduced 8.0.0; fixed 8.0.1"]}],"null_published_at":"2026-11-06T00:30:00.627Z","source_updated_at":"2026-09-10T03:51:13.889Z","source_disclosed_at":"2026-08-03T21:05:26.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:42:10.711Z"},{"id":"NVI-00007985","kind":"vulnerability","title":"Guzzle: Noncanonical cookie domain keeps subdomain scope","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-f7vp-7xgx-4w4r","CVE-2026-69245"],"plain_summary":"OSV carries this publisher advisory for guzzlehttp/guzzle, guzzlehttp/guzzle. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 7.15.2 for guzzlehttp/guzzle. Confirm the publisher’s latest guidance.","source_ids":["sr-f12dea06d2d820b1e1993c3481a90425"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 8.0.1 for guzzlehttp/guzzle. Confirm the publisher’s latest guidance.","source_ids":["sr-f12dea06d2d820b1e1993c3481a90425"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-b8ee5badafcff9f9e221d3d3b2f133c4"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.199%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.09819. Missing scores are unknown.","source_id":"sr-b8ee5badafcff9f9e221d3d3b2f133c4"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-f12dea06d2d820b1e1993c3481a90425","url":"https://github.com/advisories/GHSA-f7vp-7xgx-4w4r","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-f7vp-7xgx-4w4r","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:10.711Z"},{"id":"sr-b8ee5badafcff9f9e221d3d3b2f133c4","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-69245","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.384Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-f12dea06d2d820b1e1993c3481a90425"],"technology":"guzzlehttp/guzzle","known_exclusions":[],"conditions_summary":"### Impact\n\n`SetCookie::matchesDomain()` gives every subdomain of a cookie `Domain` that cookie unless it recognizes the `Domain` as an IP literal or a numeric host, and it decides that from the domain's own text, so two spellings a transport reads as an address keep subdomain scope. On `7.15`, hexadecimal and mixed-base forms such as `0x7f000001` and `0177.0.0.0x1` go unrecognized while libcurl 8.21.0 reads both as `127.0.0.1`, so closing them completes the rule `GHSA-g446-98w2-8p5w` (`CVE-2026-59883`) set out to establish, which cited the WHATWG IPv4 parser and so already admitted a `0x` part. A percent-escaped `Domain` keeps that scope on both branches for a different reason: percent-decoding sits above numeric parsing, so `192.168.0.%31` and `127.0.0.1%2e` are registered names in the URI grammar rather than address literals, and no numeric rule in any base classifies them, while libcurl decodes the host before it resolves and reads them as `192.168.0.1` and `127.0.0.1`. The escape must fall in the rightmost label on `8.0.0`, which already catches a decimal, octal or `0x` part there, but not on `7.15`, where `%31%32%37.0.0.0x1` also reads as `127.0.0.1`; `8.0.0` is affected in t","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 7.15.2"]},{"certainty":"source_listed","source_ids":["sr-f12dea06d2d820b1e1993c3481a90425"],"technology":"guzzlehttp/guzzle","known_exclusions":[],"conditions_summary":"### Impact\n\n`SetCookie::matchesDomain()` gives every subdomain of a cookie `Domain` that cookie unless it recognizes the `Domain` as an IP literal or a numeric host, and it decides that from the domain's own text, so two spellings a transport reads as an address keep subdomain scope. On `7.15`, hexadecimal and mixed-base forms such as `0x7f000001` and `0177.0.0.0x1` go unrecognized while libcurl 8.21.0 reads both as `127.0.0.1`, so closing them completes the rule `GHSA-g446-98w2-8p5w` (`CVE-2026-59883`) set out to establish, which cited the WHATWG IPv4 parser and so already admitted a `0x` part. A percent-escaped `Domain` keeps that scope on both branches for a different reason: percent-decoding sits above numeric parsing, so `192.168.0.%31` and `127.0.0.1%2e` are registered names in the URI grammar rather than address literals, and no numeric rule in any base classifies them, while libcurl decodes the host before it resolves and reads them as `192.168.0.1` and `127.0.0.1`. The escape must fall in the rightmost label on `8.0.0`, which already catches a decimal, octal or `0x` part there, but not on `7.15`, where `%31%32%37.0.0.0x1` also reads as `127.0.0.1`; `8.0.0` is affected in t","public_affected_ranges":["ECOSYSTEM: introduced 8.0.0; fixed 8.0.1"]}],"null_published_at":"2026-11-05T03:52:54.830Z","source_updated_at":"2026-09-10T03:51:13.889Z","source_disclosed_at":"2026-08-03T21:05:26.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:42:10.711Z"},{"id":"NVI-00007985","kind":"vulnerability","title":"Guzzle: Noncanonical cookie domain keeps subdomain scope","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-f7vp-7xgx-4w4r","CVE-2026-69245"],"plain_summary":"OSV carries this publisher advisory for guzzlehttp/guzzle, guzzlehttp/guzzle. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 7.15.2 for guzzlehttp/guzzle. Confirm the publisher’s latest guidance.","source_ids":["sr-f12dea06d2d820b1e1993c3481a90425"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 8.0.1 for guzzlehttp/guzzle. Confirm the publisher’s latest guidance.","source_ids":["sr-f12dea06d2d820b1e1993c3481a90425"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-f12dea06d2d820b1e1993c3481a90425","url":"https://github.com/advisories/GHSA-f7vp-7xgx-4w4r","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-f7vp-7xgx-4w4r","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:10.711Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-f12dea06d2d820b1e1993c3481a90425"],"technology":"guzzlehttp/guzzle","known_exclusions":[],"conditions_summary":"### Impact\n\n`SetCookie::matchesDomain()` gives every subdomain of a cookie `Domain` that cookie unless it recognizes the `Domain` as an IP literal or a numeric host, and it decides that from the domain's own text, so two spellings a transport reads as an address keep subdomain scope. On `7.15`, hexadecimal and mixed-base forms such as `0x7f000001` and `0177.0.0.0x1` go unrecognized while libcurl 8.21.0 reads both as `127.0.0.1`, so closing them completes the rule `GHSA-g446-98w2-8p5w` (`CVE-2026-59883`) set out to establish, which cited the WHATWG IPv4 parser and so already admitted a `0x` part. A percent-escaped `Domain` keeps that scope on both branches for a different reason: percent-decoding sits above numeric parsing, so `192.168.0.%31` and `127.0.0.1%2e` are registered names in the URI grammar rather than address literals, and no numeric rule in any base classifies them, while libcurl decodes the host before it resolves and reads them as `192.168.0.1` and `127.0.0.1`. The escape must fall in the rightmost label on `8.0.0`, which already catches a decimal, octal or `0x` part there, but not on `7.15`, where `%31%32%37.0.0.0x1` also reads as `127.0.0.1`; `8.0.0` is affected in t","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 7.15.2"]},{"certainty":"source_listed","source_ids":["sr-f12dea06d2d820b1e1993c3481a90425"],"technology":"guzzlehttp/guzzle","known_exclusions":[],"conditions_summary":"### Impact\n\n`SetCookie::matchesDomain()` gives every subdomain of a cookie `Domain` that cookie unless it recognizes the `Domain` as an IP literal or a numeric host, and it decides that from the domain's own text, so two spellings a transport reads as an address keep subdomain scope. On `7.15`, hexadecimal and mixed-base forms such as `0x7f000001` and `0177.0.0.0x1` go unrecognized while libcurl 8.21.0 reads both as `127.0.0.1`, so closing them completes the rule `GHSA-g446-98w2-8p5w` (`CVE-2026-59883`) set out to establish, which cited the WHATWG IPv4 parser and so already admitted a `0x` part. A percent-escaped `Domain` keeps that scope on both branches for a different reason: percent-decoding sits above numeric parsing, so `192.168.0.%31` and `127.0.0.1%2e` are registered names in the URI grammar rather than address literals, and no numeric rule in any base classifies them, while libcurl decodes the host before it resolves and reads them as `192.168.0.1` and `127.0.0.1`. The escape must fall in the rightmost label on `8.0.0`, which already catches a decimal, octal or `0x` part there, but not on `7.15`, where `%31%32%37.0.0.0x1` also reads as `127.0.0.1`; `8.0.0` is affected in t","public_affected_ranges":["ECOSYSTEM: introduced 8.0.0; fixed 8.0.1"]}],"null_published_at":"2026-10-31T22:13:22.823Z","source_updated_at":"2026-09-10T03:51:13.889Z","source_disclosed_at":"2026-08-03T21:05:26.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:10.711Z"}],"next_cursor":null,"snapshot_revision":"42594"}