CVE-2026-67353 — guzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of Service
guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. At…
Published: 2026-08-01 · CVSS: 6.9 · CVSS 4.0
guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and generate oversized Cookie headers that fail in handlers or destination servers.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7