Executive brief
Guzzle, a popular PHP library for making web requests, contains a vulnerability in how it handles website cookies. A malicious server can send an unlimited number of large cookies, which Guzzle will store and attempt to send back in future requests. This can lead to service outages by exhausting memory or causing requests to be rejected by other servers because they are too large.
Technical details
A denial-of-service vulnerability exists in Guzzle's built-in CookieJar implementation due to improper resource limiting (CWE-770, CWE-1325). The component accepts an unbounded number of Set-Cookie headers of any size from a single response. When making subsequent requests, Guzzle attempts to include all matching cookies in a single Cookie header without length restrictions. An attacker-controlled server can exploit this to cause excessive memory consumption or trigger request failures at proxies or destination servers that enforce header size limits. The issue is resolved in version 7.15.1 by enforcing an 8,190-byte limit per cookie and a maximum of 50 cookies per response.
Affected products
- guzzlehttp guzzle < 7.15.1
Timeline
- 2026-07-18: patched: Version 7.15.1 released
- 2026-07-20: advisory: GitHub Advisory GHSA-f283-ghqc-fg79 published
References
- https://api.github.com/users/GrahamCampbell
- https://github.com/GrahamCampbell
- https://api.github.com/users/GrahamCampbell/gists%7B/gist_id%7D
- https://api.github.com/users/GrahamCampbell/repos
- https://avatars.githubusercontent.com/u/2829600?v=4
- https://api.github.com/users/GrahamCampbell/events%7B/privacy%7D