Executive brief
Guzzle, a popular PHP HTTP client library, contains a vulnerability in how it handles website cookies. A malicious server can send an unlimited number of large cookies, causing the application to consume excessive memory or crash. This can lead to a denial-of-service condition where the application becomes unresponsive or fails to communicate with other legitimate services.
Technical details
A denial of service vulnerability exists in guzzlehttp/guzzle's CookieJar implementation (CWE-770, CWE-1325). The library fails to impose limits on the number of 'Set-Cookie' header fields or the size of individual cookies received in an HTTP response. An attacker-controlled server can return a large volume of cookie data, leading to excessive memory consumption. Furthermore, Guzzle may generate oversized 'Cookie' headers in subsequent requests that exceed the limits of downstream handlers, proxies, or destination servers, causing request failures. The issue is resolved in version 7.15.1, which introduces an 8,190-byte limit per cookie and a maximum of 50 cookies per response.
Affected products
- guzzlehttp guzzle < 7.15.1
Timeline
- 2026-07-18: advisory: Original GHSA-f283-ghqc-fg79 published by maintainers
- 2026-08-01: disclosed: CVE-2026-67353 published to NVD
- 2026-08-04: patched: Advisory updated to reflect patch availability in 7.15.1