The vulnerability is a Denial of Service caused by Guzzle's CookieJar accepting unlimited Set-Cookie header fields with no size restrictions. This allows an attacker to send many large cookies from a malicious server, causing Guzzle to consume excessive memory and generate oversized Cookie headers that fail in internal handlers or destination servers. The flaw is identified as CWE-770, making the application vulnerable to memory exhaustion attacks.

The affected product is guzzlehttp/guzzle, specifically all versions before 7.15.1. Any PHP application that includes Guzzle as a dependency and communicates with external HTTP servers is at risk when using these older library versions.

With a CVSS score of 6.9 the risk is moderate. The EPSS score is not available and the vulnerability is not listed in KEV. The attack vector is inferred to be a remote attacker who controls a server that sends malicious Set-Cookie headers to a Guzzle client. By exploiting the unbounded cookie storage, the attacker can trigger high memory usage or failure of cookie header generation, resulting in a service disruption.