CVE-2026-67353: guzzlehttp Guzzle denial of service in CookieJar

CVE-2026-67353 · Severity: medium · CVSS 5.3 · Published 2026-08-01

guzzlehttp Guzzle is a widely-used PHP HTTP client library that handles network requests and responses, including cookie management. A malicious server can return an unlimited number of large cookies that Guzzle stores in memory without restriction, causing the library to consume excessive memory and generate oversized Cookie headers that fail in downstream handlers, proxies, or destination servers. This denial-of-service attack can disrupt services that rely on Guzzle for API communication or web scraping.

Technologies: guzzlehttp/guzzle (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-67353 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-67353 being exploited in the wild.
How severe is CVE-2026-67353?
Medium severity, with a CVSS score of 5.3, published 1 August 2026.
Which products and versions are affected?
guzzlehttp/guzzle (Packagist) ECOSYSTEM:introduced=0,fixed=7.15.1.
Is there a fix for CVE-2026-67353?
Yes. guzzlehttp/guzzle (Packagist): upgrade to 7.15.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67353 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-67353?
Check whether you run guzzlehttp/guzzle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • guzzlehttp/guzzle (Packagist): upgrade to 7.15.1 or later
    composer require guzzlehttp/guzzle:^7.15.1

Technical details

The vulnerability is an unbounded resource allocation (CWE-770) in Guzzle's built-in CookieJar middleware. The root cause is the absence of size and count limits on Set-Cookie header fields accepted from HTTP responses and on generated Cookie headers sent in subsequent requests. An attacker controlling a server or performing a man-in-the-middle attack can return many large Set-Cookie fields; Guzzle will store them all and later include every matching cookie in outgoing requests without limiting total header size. This increases memory consumption and can cause requests to fail when downstream handlers, proxies, or destination servers reject headers exceeding their size limits. The attack vector is network-based with no authentication required. Affected versions are those before 7.15.1; the patch introduces per-response cookie count limits (50 insertions), per-field size limits (8,190 bytes), and per-header output limits (150 cookie pairs, 8,190-byte header line). Applications can mitigate by using separate cookie jars per host, disabling cookies for untrusted origins, or implementing a custom CookieJarInterface.

Affected products

  • guzzlehttp Guzzle before 7.15.1

Identifiers

  • CVE-2026-67353
  • GHSA-f283-ghqc-fg79

Timeline

  • 2026-07-18: disclosed: Advisory GHSA-f283-ghqc-fg79 published on GitHub
  • 2026-07-18: patched: Fix available in version 7.15.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.