CVE-2026-67353 Details
Description
guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and generate oversized Cookie headers that fail in handlers or destination servers.
A denial-of-service vulnerability has been identified in GuzzleHTTP Guzzle versions prior to 7.15.1. The issue arises in the CookieJar component, which accepts an unlimited number of Set-Cookie header fields without any size restrictions. This flaw allows attackers to send large cookies from a malicious server, leading Guzzle to store excessive data in memory. Consequently, Guzzle generates oversized Cookie headers that can fail in handlers or on destination servers.
Users can upgrade to Guzzle version 7.15.1 or later, where this vulnerability is patched. If an immediate upgrade is not possible, it is recommended to use separate cookie jars for untrusted origins, disable cookie handling for such requests, and clear the cookie jar after receiving an untrusted response before reusing it. Applications that must accept cookies from untrusted sources can implement a custom CookieJarInterface that enforces appropriate limits.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 1, 2026 | New CVE Received | [email protected] |