CVE-2022-29248

Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cookie header, allowing a malicious server to set cookies for unrelated domains. The cookie middleware is disabled by default, so most library consumers will not be affected by this issue. Only those who manually add the cookie middleware to the handler stack or construct the client with ['cookies' => true] are affected. Moreover, those who do not use the same Guzzle client to call multiple domains and have disabled redirect forwarding are not affected by this vulnerability. Guzzle versions 6.5.6 and 7.4.3 contain a patch for this issue. As a workaround, turn off the cookie middleware.

• CWE-200
• CWE-565

• https://github.com/guzzle/guzzle/commit/74a8602c6faec9ef74b7a9391ac82c5e65b1cdabPatch, Third Party Advisory
• https://github.com/guzzle/guzzle/pull/3018Issue Tracking, Patch, Third Party Advisory
• https://github.com/guzzle/guzzle/security/advisories/GHSA-cwmx-hcrq-mhc3Third Party Advisory
• https://www.debian.org/security/2022/dsa-5246Third Party Advisory
• https://www.drupal.org/sa-core-2022-010Patch, Third Party Advisory
• https://github.com/guzzle/guzzle/commit/74a8602c6faec9ef74b7a9391ac82c5e65b1cdabPatch, Third Party Advisory
• https://github.com/guzzle/guzzle/pull/3018Issue Tracking, Patch, Third Party Advisory
• https://github.com/guzzle/guzzle/security/advisories/GHSA-cwmx-hcrq-mhc3Third Party Advisory
• https://www.debian.org/security/2022/dsa-5246Third Party Advisory
• https://www.drupal.org/sa-core-2022-010Patch, Third Party Advisory

Published

May 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29242GOST engine is a reference implementation of the Russian GOS…7.5
• CVE-2022-29243Nextcloud Server is the file server software for Nextcloud, …4.3
• CVE-2022-29244npm pack ignores root-level .gitignore and .npmignore file e…7.5
• CVE-2022-29245SSH.NET is a Secure Shell (SSH) library for .NET. In version…5.9
• CVE-2022-29246Azure RTOS USBX is a USB host, device, and on-the-go (OTG) e…9.8
• CVE-2022-29247Electron is a framework for writing cross-platform desktop a…9.8
• CVE-2022-29249JavaEZ is a library that adds new functions to make Java eas…7.5
• CVE-2022-2925Cross-site Scripting (XSS) - Stored in GitHub repository app…5.4
• CVE-2022-29250GLPI is a Free Asset and IT Management Software package, tha…6.5
• CVE-2022-29251XWiki Platform Flamingo Theme UI is a tool that allows custo…6.1
• CVE-2022-29252XWiki Platform Wiki UI Main Wiki is a package for managing s…6.1
• CVE-2022-29253XWiki Platform is a generic wiki platform offering runtime s…2.7