Executive brief
guzzlehttp Guzzle is a widely-used PHP HTTP client library that handles network requests and responses, including cookie management. A malicious server can return an unlimited number of large cookies that Guzzle stores in memory without restriction, causing the library to consume excessive memory and generate oversized Cookie headers that fail in downstream handlers, proxies, or destination servers. This denial-of-service attack can disrupt services that rely on Guzzle for API communication or web scraping.
Technical details
The vulnerability is an unbounded resource allocation (CWE-770) in Guzzle's built-in CookieJar middleware. The root cause is the absence of size and count limits on Set-Cookie header fields accepted from HTTP responses and on generated Cookie headers sent in subsequent requests. An attacker controlling a server or performing a man-in-the-middle attack can return many large Set-Cookie fields; Guzzle will store them all and later include every matching cookie in outgoing requests without limiting total header size. This increases memory consumption and can cause requests to fail when downstream handlers, proxies, or destination servers reject headers exceeding their size limits. The attack vector is network-based with no authentication required. Affected versions are those before 7.15.1; the patch introduces per-response cookie count limits (50 insertions), per-field size limits (8,190 bytes), and per-header output limits (150 cookie pairs, 8,190-byte header line). Applications can mitigate by using separate cookie jars per host, disabling cookies for untrusted origins, or implementing a custom CookieJarInterface.
Affected products
- guzzlehttp Guzzle before 7.15.1
Timeline
- 2026-07-18: disclosed: Advisory GHSA-f283-ghqc-fg79 published on GitHub
- 2026-07-18: patched: Fix available in version 7.15.1