PT-2026-67326 · Composer · Guzzle
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
guzzlehttp/guzzle versions prior to 7.15.1
Description
A denial of service issue exists in the
CookieJar component. The system accepts an unlimited number of Set-Cookie header fields without size restrictions. A malicious server can return numerous large cookies, forcing the application to store excessive data in memory and generate oversized Cookie headers. This can lead to increased memory consumption, higher processing times, and request failures when the generated header exceeds the limits of a handler, HTTP implementation, proxy, or destination server. Additionally, a server on a sibling host can set parent-domain cookies that affect other sibling services using the same jar. This issue occurs when built-in cookie support is enabled and a jar is reused after receiving an attacker-controlled response.Recommendations
Update guzzlehttp/guzzle to version 7.15.1 or later.
As a temporary workaround, avoid enabling a shared built-in cookie jar for requests to untrusted origins.
Use separate jars per host or trust boundary.
Disable cookie handling for untrusted requests.
Discard or clear the jar after receiving an untrusted response before it is reused.
Implement a custom
CookieJarInterface to enforce suitable limits if cookies from untrusted peers must be accepted.Exploit
Fix
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Guzzle