SB2026110686 - Multiple vulnerabilities in guzzle

Description

This security bulletin contains information about 3 vulnerabilities.

1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-67353)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to degrade application availability and cause subsequent HTTP requests to fail.

The vulnerability exists due to missing cookie count and size limits in Guzzle's built-in CookieJar when applications enable cookie support and retain or reuse the jar. An unauthenticated remote attacker can return many large cookies from a controlled server, increasing memory consumption and producing oversized headers on later matching requests.

2) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-67354)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to obtain sensitive URI fragments intended to remain private to the client.

The vulnerability exists due to Guzzle's RedirectMiddleware retaining fragments in generated Referer headers when the non-default allow_redirects.referer setting is enabled and a request containing a sensitive fragment follows a same-scheme redirect. An unauthenticated remote attacker can read the disclosed fragment from the incoming header when controlling the less-trusted redirect destination.

3) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-67355)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to obtain sensitive host-only cookies intended for a parent host.

The vulnerability exists due to Guzzle's CookieJar treating cookies with absent or empty Domain attributes as domain-scoped rather than host-only. An unauthenticated remote attacker controlling or observing a child host can receive these cookies when cookie support is enabled and the application reuses the parent's built-in jar for a later child request satisfying the cookie's other restrictions.

Remediation

Install update from vendor's website.

References

• https://github.com/guzzle/guzzle/security/advisories/GHSA-f283-ghqc-fg79
• https://github.com/guzzle/guzzle/security/advisories/GHSA-h95v-h523-3mw8
• https://github.com/guzzle/guzzle/security/advisories/GHSA-wm3w-8rrp-j577