CVE-2026-67353

guzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of Service

Published Aug 1, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and generate oversized Cookie headers that fail in handlers or destination servers.

Analysis

Technical impact

The vulnerability is a Denial of Service caused by Guzzle's CookieJar accepting unlimited Set-Cookie header fields with no size restrictions. This allows an attacker to send many large cookies from a malicious server, causing Guzzle to consume excessive memory and generate oversized Cookie headers that fail in internal handlers or destination servers. The flaw is identified as CWE-770, making the application vulnerable to memory exhaustion attacks.

Affected Systems

The affected product is guzzlehttp/guzzle, specifically all versions before 7.15.1. Any PHP application that includes Guzzle as a dependency and communicates with external HTTP servers is at risk when using these older library versions.

Risk and Exploitability

With a CVSS score of 6.9 the risk is moderate. The EPSS score is not available and the vulnerability is not listed in KEV. The attack vector is inferred to be a remote attacker who controls a server that sends malicious Set-Cookie headers to a Guzzle client. By exploiting the unbounded cookie storage, the attacker can trigger high memory usage or failure of cookie header generation, resulting in a service disruption.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

guzzle

unaffected

Version	Status	Constraints
`0`	affected	< 7.15.1
`7.15.1`	unaffected	—

No data.

Vendor Product Versions

Guzzlephp

Guzzle

Version	Status	Scheme	Platform
`—`	affected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Guzzle to version 7.15.1 or later to remove the unbounded cookie storage flaw.
Create and use a custom CookieJar implementation that enforces a maximum size for Set-Cookie headers, preventing memory exhaustion.
If an upgrade or custom jar cannot be applied immediately, configure the Guzzle client to disable cookie handling for untrusted external connections by setting the ‘cookies’ option to false or selectively rejecting Set-Cookie headers from those sources.

Generated by OpenCVE AI on August 2, 2026 at 03:12 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-f283-ghqc-fg79	Guzzle: Unbounded response cookies risk denial of service

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.418% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/guzzle/guzzle/security/advisories/GHSA-f283-ghqc-fg79
https://www.vulncheck.com/advisories/guzzlehttp-guzzle-before-unbounded-cookie-denial-of-service

History

Aug 3, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 1, 2026 12:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and generate oversized Cookie headers that fail in handlers or destination servers.
Title		guzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of Service
First Time appeared		Guzzlephp Guzzlephp guzzle
Weaknesses		CWE-770
CPEs		cpe:2.3:a:guzzlephp:guzzle::::::::
Vendors & Products		Guzzlephp Guzzlephp guzzle
References		https://github.com/guzzle/guzzle/security/advisories/GHSA-f283-ghqc-fg79 https://www.vulncheck.com/advisories/guzzlehttp-guzzle-before-unbounded-cookie-denial-of-service
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`