CVE-2026-67353 guzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of Service
Attackers can cause memory exhaustion and service disruption in applications using Guzzle by sending excessive cookies from malicious servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-67353?
CVE-2026-67353 is a medium-severity denial of service vulnerability in guzzle, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and generate oversized Cookie headers that fail in handlers or destination servers.
Weakness: CWE-770
Which versions are affected by CVE-2026-67353?
2 open source packages ship an affected version, including guzzlehttp/guzzle.
| Package | Affected | Fixed in |
|---|---|---|
guzzlehttp/guzzle Packagist | All versions | 7.15.1 |
guzzlehttp/guzzle Packagist | All versions | 7.15.1 |
How do I fix CVE-2026-67353?
Upgrade guzzlehttp/guzzle to 7.15.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-67353 being exploited?
There is no known exploitation of CVE-2026-67353 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-67353, GHSA-f283-ghqc-fg79, MINI-4h5h-q37h-35xq, MINI-5qpw-wwq4-2c3r, MINI-9qx5-g6r9-p6h7, MINI-g9hf-3cwc-qq4c and 5 more.