A cookie set for an IP address written in an unusual way can be sent to other hosts whose names end in that address. A host like that can also plant cookies that Guzzle later sends to the address. That can leak a session id or token, or let a look-alike host fix a session for you.
Guzzle checked whether a cookie's Domain was an IP address by reading its text. Hexadecimal, mixed-base and percent-escaped spellings slipped through, while the network layer still read them as an address. This finishes the job of the earlier fix for GHSA-g446-98w2-8p5w.
Who is affected
Apps on guzzlehttp/guzzle before 7.15.2, or 8.0.0, that use Guzzle's cookie jar, reach a server by one of those unusual address spellings, and also contact a host whose name ends in it. The Guzzle advisory says no public DNS name works this way, so the risk is in private, split-horizon and container networks. Apps that don't use Guzzle's cookies, keep a separate jar per host, or only use ordinary host names aren't affected.
What to do
Update to 7.15.2, or to 8.0.1 on 8.x. The fix only sends such cookies back to the exact host. Until you can update, use a separate cookie jar for each host or trust boundary, and write IP addresses in the normal dotted form.
Guzzle notes that IP addresses written with full-width digits are still matched loosely after this fix.
Reported by GrahamCampbell.