CVE-2026-67353
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
guzzlehttp/guzzle before version 7.15.1 contains a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and generate oversized Cookie headers that fail in handlers or destination servers.
Risk Assessment
An attacker can cause memory exhaustion or application crashes, leading to denial of service for legitimate users.
Recommendation
Update guzzlehttp/guzzle to version 7.15.1 or later.
Other vulnerabilities in guzzlehttp/guzzle
See all- CVE-2026-67355Medium
guzzlehttp/guzzle before version 7.15.1 fails to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session identifiers and authorization tokens.
- CVE-2026-67354Medium
guzzlehttp/guzzle before version 7.15.1 contains an information disclosure vulnerability in RedirectMiddleware. When the optional allow_redirects.referer setting is enabled, the middleware copies the URI fragment from the referring request into the Referer header during a redirect. An attacker controlling the redirect destination can read this fragment, potentially disclosing one-time login secrets, access tokens, and other sensitive data.
Original NVD description (English source)
guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and generate oversized Cookie headers that fail in handlers or destination servers.