guzzlehttp/guzzle vulnerabilities

guzzlehttp/guzzle before version 7.15.1 fails to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session identifiers and authorization tokens.

guzzlehttp/guzzle before version 7.15.1 contains an information disclosure vulnerability in RedirectMiddleware. When the optional allow_redirects.referer setting is enabled, the middleware copies the URI fragment from the referring request into the Referer header during a redirect. An attacker controlling the redirect destination can read this fragment, potentially disclosing one-time login secrets, access tokens, and other sensitive data.

guzzlehttp/guzzle before version 7.15.1 contains a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and generate oversized Cookie headers that fail in handlers or destination servers.