guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields… (CVE-2026-67353)
guzzlehttp/guzzle versions before 7.15.1 have a denial of service vulnerability in the CookieJar component. This vulnerability arises because the CookieJar accepts unlimited Set-Cookie header fields without size restrictions. An attacker can exploit this by returning many large cookies from a malicious server, causing excessive memory consumption and oversized Cookie headers that may fail in request handlers or destination servers. The vulnerability has a CVSS score of 5.3, indicating medium severity.
AI Analysis
Technical Summary
The guzzlehttp/guzzle library prior to version 7.15.1 contains a denial of service vulnerability (CVE-2026-67353) in its CookieJar implementation. The issue is due to the lack of size restrictions on the number and size of Set-Cookie header fields accepted. This allows an attacker controlling a malicious server to send numerous large cookies, causing the client to store excessive data in memory and generate oversized Cookie headers. These oversized headers can cause failures in HTTP handlers or destination servers, resulting in denial of service conditions. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling).
Potential Impact
Exploitation of this vulnerability can lead to denial of service by exhausting client memory resources and causing oversized HTTP Cookie headers that fail in handlers or destination servers. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
A fix is available in guzzlehttp/guzzle version 7.15.1. Users should upgrade to version 7.15.1 or later to remediate this vulnerability. Patch status is not explicitly confirmed in the provided data, but the version boundary indicates the fix is in 7.15.1. No other mitigation or temporary workaround is indicated.
guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields… (CVE-2026-67353)
Description
guzzlehttp/guzzle versions before 7.15.1 have a denial of service vulnerability in the CookieJar component. This vulnerability arises because the CookieJar accepts unlimited Set-Cookie header fields without size restrictions. An attacker can exploit this by returning many large cookies from a malicious server, causing excessive memory consumption and oversized Cookie headers that may fail in request handlers or destination servers. The vulnerability has a CVSS score of 5.3, indicating medium severity.
CVSS v3.1
Score 5.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The guzzlehttp/guzzle library prior to version 7.15.1 contains a denial of service vulnerability (CVE-2026-67353) in its CookieJar implementation. The issue is due to the lack of size restrictions on the number and size of Set-Cookie header fields accepted. This allows an attacker controlling a malicious server to send numerous large cookies, causing the client to store excessive data in memory and generate oversized Cookie headers. These oversized headers can cause failures in HTTP handlers or destination servers, resulting in denial of service conditions. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling).
Potential Impact
Exploitation of this vulnerability can lead to denial of service by exhausting client memory resources and causing oversized HTTP Cookie headers that fail in handlers or destination servers. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
A fix is available in guzzlehttp/guzzle version 7.15.1. Users should upgrade to version 7.15.1 or later to remediate this vulnerability. Patch status is not explicitly confirmed in the provided data, but the version boundary indicates the fix is in 7.15.1. No other mitigation or temporary workaround is indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-3fvr-2jw6-crq4
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-67353"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a6e6290bf32cb7a344f5e22
Added to database: 08/01/2026, 21:18:08 UTC
Last enriched: 08/01/2026, 21:19:39 UTC
Last updated: 08/01/2026, 22:37:56 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.