guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields… (CVE-2026-67353)
guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and generate oversized Cookie headers that fail in handlers or destination servers.
AI Analysis
Technical Summary
The guzzlehttp/guzzle library prior to version 7.15.1 contains a denial of service vulnerability (CVE-2026-67353) in its CookieJar implementation. The issue is due to the lack of size restrictions on the number and size of Set-Cookie header fields accepted. This allows an attacker controlling a malicious server to send numerous large cookies, causing the client to store excessive data in memory and generate oversized Cookie headers. These oversized headers can cause failures in HTTP handlers or destination servers, resulting in denial of service conditions. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling).
Potential Impact
Exploitation of this vulnerability can lead to denial of service by exhausting client memory resources and causing oversized HTTP Cookie headers that fail in handlers or destination servers. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
A fix is available in guzzlehttp/guzzle version 7.15.1. Users should upgrade to version 7.15.1 or later to remediate this vulnerability. Patch status is not explicitly confirmed in the provided data, but the version boundary indicates the fix is in 7.15.1. No other mitigation or temporary workaround is indicated.
guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields… (CVE-2026-67353)
Description
guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and generate oversized Cookie headers that fail in handlers or destination servers.
CVSS v3.1
Score 5.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The guzzlehttp/guzzle library prior to version 7.15.1 contains a denial of service vulnerability (CVE-2026-67353) in its CookieJar implementation. The issue is due to the lack of size restrictions on the number and size of Set-Cookie header fields accepted. This allows an attacker controlling a malicious server to send numerous large cookies, causing the client to store excessive data in memory and generate oversized Cookie headers. These oversized headers can cause failures in HTTP handlers or destination servers, resulting in denial of service conditions. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling).
Potential Impact
Exploitation of this vulnerability can lead to denial of service by exhausting client memory resources and causing oversized HTTP Cookie headers that fail in handlers or destination servers. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
A fix is available in guzzlehttp/guzzle version 7.15.1. Users should upgrade to version 7.15.1 or later to remediate this vulnerability. Patch status is not explicitly confirmed in the provided data, but the version boundary indicates the fix is in 7.15.1. No other mitigation or temporary workaround is indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-3fvr-2jw6-crq4
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-67353"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a6e6290bf32cb7a344f5e22
Added to database: 08/01/2026, 21:18:08 UTC
Last enriched: 08/01/2026, 21:19:39 UTC
Last updated: 09/12/2026, 12:03:00 UTC
Views: 43
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.