CVE-2026-67353

Name of the Vulnerable Software and Affected Versions guzzlehttp/guzzle versions prior to 7.15.1

Description A denial of service issue exists in the CookieJar component. The system accepts an unlimited number of Set-Cookie header fields without size restrictions. A malicious server can return numerous large cookies, forcing the application to store excessive data in memory and generate oversized Cookie headers. This can lead to increased memory consumption, higher processing times, and request failures when the generated header exceeds the limits of a handler, HTTP implementation, proxy, or destination server. Additionally, a server on a sibling host can set parent-domain cookies that affect other sibling services using the same jar. This issue occurs when built-in cookie support is enabled and a jar is reused after receiving an attacker-controlled response.

Recommendations Update guzzlehttp/guzzle to version 7.15.1 or later. As a temporary workaround, avoid enabling a shared built-in cookie jar for requests to untrusted origins. Use separate jars per host or trust boundary. Disable cookie handling for untrusted requests. Discard or clear the jar after receiving an untrusted response before it is reused. Implement a custom CookieJarInterface to enforce suitable limits if cookies from untrusted peers must be accepted.