Allocation of Resources Without Limits or Throttling in guzzle - CVE-2026-67353
Published: November 6, 2026
Vulnerability identifier: #VU159744
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-67353
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to degrade application availability and cause subsequent HTTP requests to fail.
The vulnerability exists due to missing cookie count and size limits in Guzzle's built-in CookieJar when applications enable cookie support and retain or reuse the jar. An unauthenticated remote attacker can return many large cookies from a controlled server, increasing memory consumption and producing oversized headers on later matching requests.
Affected software
guzzle
How to mitigate CVE-2026-67353
Install security update from vendor's website.
guzzle - update to 7.15.1