CVE-2026-67353 – guzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of Service

CVE ID :CVE-2026-67353

Published : Aug. 1, 2026, 1:17 p.m. | 32 minutes ago

Description :guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and generate oversized Cookie headers that fail in handlers or destination servers.

Severity: 6.9 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…