CVE-2026-67353: Guzzle HTTP DoS Vulnerability

CVE-2026-67353 Overview

CVE-2026-67353 is a denial of service vulnerability in the guzzlehttp/guzzle PHP HTTP client library affecting versions before 7.15.1. The flaw resides in the CookieJar component, which accepts an unlimited number of Set-Cookie header fields with no size restrictions. A malicious server can return many large cookies to a Guzzle client, causing the library to store excessive data in memory. Subsequent requests generate oversized Cookie headers that fail in HTTP handlers or at destination servers. The weakness is classified under CWE-770: Allocation of Resources Without Limits or Throttling.

Critical Impact
Attacker-controlled servers can exhaust memory and break outbound HTTP requests in PHP applications that rely on Guzzle's cookie handling.

Affected Products

guzzlehttp/guzzle versions prior to 7.15.1
PHP applications and libraries depending on vulnerable Guzzle releases
Server-side integrations that follow redirects or contact untrusted origins with CookieJar enabled

Discovery Timeline

2026-08-01 - CVE-2026-67353 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67353

Vulnerability Analysis

Guzzle's CookieJar accumulates cookies returned by remote servers via the Set-Cookie response header. The implementation applies no ceiling on the number of stored cookies and no per-cookie or aggregate size limit. When a client issues a request to a server that returns hundreds or thousands of large Set-Cookie values, Guzzle allocates memory proportional to the attacker-supplied payload.

On later requests to the same domain, the library reassembles those cookies into a single outgoing Cookie header. The resulting header can exceed process memory limits, HTTP handler buffers, or upstream server header-size thresholds. The failure surfaces as PHP memory exhaustion errors, 413/431 responses, or dropped connections from downstream services.

Root Cause

The root cause is missing input validation and resource throttling in the cookie storage pipeline. CookieJar treats server responses as trusted with respect to volume and length. There is no enforcement of the practical browser conventions that cap cookies per domain and bytes per cookie.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker controls or influences an HTTP endpoint that a Guzzle client contacts, either directly or through a redirect chain. The malicious server returns a response containing a large volume of oversized Set-Cookie headers. The vulnerability impacts availability only; confidentiality and integrity are not affected.

Verified proof-of-concept code is not published in the referenced advisories. Refer to the GitHub Security Advisory GHSA-f283-ghqc-fg79 and the VulnCheck Advisory for maintainer analysis.

Detection Methods for CVE-2026-67353

Indicators of Compromise

PHP processes terminating with Allowed memory size exhausted errors during outbound HTTP calls
Unusually large Cookie headers or repeated 431 Request Header Fields Too Large responses in application logs
Sudden spikes in memory usage tied to PHP workers issuing Guzzle requests

Detection Strategies

Inventory PHP dependencies using composer show guzzlehttp/guzzle to identify installations below 7.15.1
Enable application-level logging of response header counts and sizes for outbound HTTP clients
Alert on anomalous ratios of Set-Cookie headers per response destined for Guzzle-based services

Monitoring Recommendations

Track memory consumption of PHP-FPM workers and long-running Guzzle consumers
Monitor egress HTTP traffic for repeated failures against the same remote origin
Correlate reverse-proxy 413/431 errors with backend service activity to identify header-size DoS attempts

How to Mitigate CVE-2026-67353

Immediate Actions Required

Upgrade guzzlehttp/guzzle to version 7.15.1 or later using composer update guzzlehttp/guzzle
Audit all direct and transitive dependencies, since many PHP libraries bundle Guzzle indirectly
Restrict outbound HTTP requests to trusted destinations where feasible, particularly for services that pass user-controlled URLs to Guzzle

Patch Information

The maintainers addressed the flaw in Guzzle 7.15.1 by introducing bounds on cookie count and size in CookieJar. Consult the GitHub Security Advisory GHSA-f283-ghqc-fg79 for the exact commit and release notes.

Workarounds

Disable the cookie handler by omitting the cookies request option or passing false for clients that do not require cookie persistence
Use a custom CookieJarInterface implementation that enforces maximum cookie count and byte-length limits
Terminate untrusted outbound HTTP traffic through an egress proxy that strips or truncates Set-Cookie headers

bash

# Configuration example: pin a patched Guzzle release in composer.json
composer require guzzlehttp/guzzle:^7.15.1
composer update guzzlehttp/guzzle --with-dependencies
composer show guzzlehttp/guzzle | grep versions