Loading vulnerability…
CVE-2026-67355 is an information disclosure vulnerability in guzzlehttp/guzzle affecting versions prior to 7.15.1. The flaw arises from incorrect handling of host-only cookies: instead of preserving host-only scope, the implementation stores the request host in the cookie Domain field. This causes cookies that should be restricted to a single host to be treated in a way that can make them available to related child hosts. In environments where the same cookie jar is reused across trust boundaries, an attacker controlling a child host can receive cookies intended only for a parent host, exposing sensitive authentication material such as session identifiers and authorization tokens.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.