CVE-2026-67353: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-67353 is a denial-of-service vulnerability in the guzzlehttp/guzzle PHP HTTP client library affecting all versions before 7.15.1. The flaw resides in Guzzle's built-in CookieJar, which accepts an unlimited number of Set-Cookie response header fields with no size restrictions, allowing a malicious server to exhaust client memory and generate oversized Cookie headers. It was published on August 1, 2026, with a patch released in version 7.15.1. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-1325 (Improperly Controlled Sequential Memory Allocation). Guzzle's CookieJar manages cookies independently of libcurl's native cookie engine, meaning libcurl's built-in cookie limits (introduced in response to CVE-2022-32205) do not apply. An attacker operating a malicious server can return arbitrarily many and arbitrarily large Set-Cookie headers in HTTP responses; Guzzle stores all of them in memory and, on subsequent matching requests, concatenates every matching cookie into a single Cookie header with no length cap. This can cause excessive memory consumption on the client and produce Cookie headers so large they are rejected by handlers, proxies, or destination servers. Additionally, a server on a sibling subdomain (e.g., attacker.example.com) can set parent-domain cookies that are later sent to another sibling (e.g., service.example.com), enabling cross-service denial of service within the same cookie jar (GitHub Advisory).

Successful exploitation results in a loss of availability for applications using Guzzle's built-in cookie support. A malicious or compromised server can cause the Guzzle client to consume excessive memory and CPU processing time, and can render subsequent HTTP requests to legitimate services non-functional by generating oversized Cookie headers that exceed limits in handlers, proxies, or destination servers. There is no impact on confidentiality or integrity; the vulnerability is limited to availability disruption of the affected client application (GitHub Advisory, Github Advisory).

1. Identify a target: Locate an application that uses guzzlehttp/guzzle (version < 7.15.1) with the built-in CookieJar enabled and that makes HTTP requests to attacker-controllable or attacker-influenced servers.
2. Set up a malicious server: Configure an HTTP server to respond with a large number of Set-Cookie headers per response, each containing large cookie values (e.g., 50+ cookies with values approaching or exceeding 8,190 bytes each).
3. Trigger the client request: Cause the target Guzzle client to send a request to the malicious server (e.g., via a redirect, SSRF, or by controlling a third-party API endpoint the application calls).
4. Exhaust client memory: The malicious server returns responses with many oversized Set-Cookie headers; Guzzle stores all of them in its CookieJar without restriction, consuming excessive memory.
5. Disrupt subsequent requests: When the Guzzle client makes follow-up requests to any matching domain, it generates a Cookie header containing all stored cookies, potentially exceeding header size limits in the HTTP handler, proxy, or destination server, causing request failures and service disruption (GitHub Advisory).

• Logs: Application error logs showing repeated HTTP request failures due to oversized headers (e.g., 431 Request Header Fields Too Large responses from destination servers or proxy errors related to header size limits).
• Process/Memory: Abnormal memory growth in the PHP process hosting the Guzzle client, particularly correlated with HTTP responses from a specific external server.
• Network: HTTP responses from a server containing an unusually high number of Set-Cookie headers or Set-Cookie values of exceptional length (approaching or exceeding several kilobytes each).
• Application Behavior: Sudden degradation or failure of outbound HTTP requests made by the application, especially after communicating with a new or untrusted external endpoint.

Upgrade guzzlehttp/guzzle to version 7.15.1 or later, which enforces the following limits: Set-Cookie field values longer than 8,190 bytes are ignored; at most 50 successful cookie insertions or replacements are accepted per response; outgoing Cookie headers are capped at 150 name=value pairs and 8,190 bytes total. If an immediate upgrade is not possible, avoid using a shared built-in CookieJar for requests to untrusted origins — use separate jars per host or trust boundary, disable cookie handling for untrusted requests, or implement a custom CookieJarInterface with appropriate size limits. Network-level controls to restrict the size of HTTP response headers from untrusted sources can also reduce exposure (GitHub Advisory).

The advisory was authored and published by GrahamCampbell, a prominent Guzzle maintainer, on July 18, 2026, and assigned CVE-2026-67353 on August 1, 2026. The fix mirrors the approach taken by cURL in response to CVE-2022-32205, applying practical per-response and per-request cookie limits. No significant broader media coverage or notable community controversy has been observed at this time (GitHub Advisory).