CVE-2026-67353
Received Received - Intake

Guzzle Denial of Service via Unlimited Cookie Storage

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and generate oversized Cookie headers that fail in handlers or destination servers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-67353
EUVD
EUVD-2026-51850

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
guzzlehttp guzzle to 7.15.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects guzzlehttp/guzzle versions before 7.15.1. It is a denial of service issue in the CookieJar component where the system accepts unlimited Set-Cookie header fields without size restrictions. Attackers can exploit this by sending many large cookies from a malicious server, causing Guzzle to store excessive data in memory and generate oversized Cookie headers that fail in handlers or destination servers.

Detection Guidance

Check Guzzle version with: composer show guzzlehttp/guzzle. If version is below 7.15.1, the system is vulnerable. Monitor memory usage for unexpected spikes during HTTP requests.

Impact Analysis

The impact includes potential denial of service where applications using vulnerable Guzzle versions may crash or become unresponsive due to excessive memory usage. Oversized Cookie headers can also cause failures in downstream systems or handlers that process these requests.

Mitigation Strategies

Upgrade Guzzle to version 7.15.1 or later using: composer require guzzlehttp/guzzle:^7.15.1. If upgrading is not possible, implement rate limiting and validate Set-Cookie header sizes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67353. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart