EUVD-2026-51850
GHSA-3fvr-2jw6-crq4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network attacker requires no privileges; scope change (S:C) reflects cross-subdomain cookie poisoning affecting separate services sharing the jar.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and generate oversized Cookie headers that fail in handlers or destination servers.
AnalysisAI
Denial of service in guzzlehttp/guzzle versions before 7.15.1 allows a malicious or compromised upstream server to exhaust memory and break outbound requests by returning unlimited, oversized Set-Cookie headers. Guzzle's built-in CookieJar imposes no cap on cookie count or field size, so attacker-controlled cookies accumulate in memory and are later copied into a single outbound Cookie header that exceeds limits in handlers, proxies, or destination servers. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the cross-subdomain cookie scope (e.g., attacker.example.com poisoning cookies for service.example.com) extends the potential blast radius beyond the initially contacted server.
Technical ContextAI
Guzzle (composer package guzzlehttp/guzzle) is a widely used PHP HTTP client library. Its built-in CookieJar implementation manages cookies independently of libcurl's native cookie engine, meaning cURL's own DoS mitigations - introduced in response to CVE-2022-32205 - do not cover Guzzle's separate in-memory store. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the CookieJar neither limits the number of Set-Cookie fields processed from a single response nor constrains individual field length. This affects CPE cpe:2.3:a:guzzle:guzzle:*:*:*:*:*:*:*:* across all versions prior to 7.15.1. Both built-in HTTP handlers (stream and curl wrappers) are affected because cookie management is handled at the Guzzle layer, not delegated to the underlying transport. Parent-domain cookies set by one host can be selected for a sibling host sharing the same jar, enabling a single compromised upstream to disrupt requests to a distinct, non-compromised service.
RemediationAI
The primary remediation is to upgrade guzzlehttp/guzzle to version 7.15.1 or later via Composer (composer require guzzlehttp/guzzle:^7.15.1). Version 7.15.1 introduces hard limits mirroring cURL's CVE-2022-32205 response: incoming Set-Cookie fields longer than 8,190 bytes are discarded, at most 50 successful cookie insertions per response are permitted, outbound Cookie headers are capped at 150 name=value pairs, and the total Cookie header line is bounded at 8,190 bytes. The upstream fix is available in pull request https://github.com/guzzle/guzzle/pull/3901 and commit 7b68220d6543f6f80fe62e633361fc9d4ead14d4. Applications that cannot immediately upgrade have three viable workarounds with trade-offs: (1) disable built-in cookie support entirely if cookies are not required - this removes the attack surface with no functional downside for cookie-free workflows; (2) use a separate, short-lived CookieJar instance per request or per trusted origin rather than a shared, reused jar - this prevents cross-request accumulation but requires application-level refactoring; or (3) implement a custom CookieJarInterface with internal size and count limits - this preserves cookie functionality but requires writing and maintaining custom code. Generic network-layer controls (WAFs, proxies) cannot reliably inspect or limit Set-Cookie headers in TLS-terminated responses and are not a reliable compensating control.
Host confusion in GuzzleHttp Guzzle before 7.15.2 and 8.0.1 allows remote attackers who can influence a fetched URI to b
Cookie domain scope bypass in Guzzle PHP HTTP client (prior to 7.15.2 and 8.0.1) allows improper cookie sharing via non-
URI fragment leakage in guzzlehttp/guzzle's RedirectMiddleware (versions before 7.15.1) exposes sensitive client-side da
Cookie scope leakage in guzzlehttp/guzzle before 7.15.1 allows an attacker controlling a child subdomain to receive host
Guzzle is a PHP HTTP client. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authenticati
Guzzle, an extensible PHP HTTP client. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low a
Guzzle, an extensible PHP HTTP client. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low a
Guzzle is an open source PHP HTTP client. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no
Guzzle is an open source PHP HTTP client. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no
Proxy-Authorization header leakage in guzzlehttp/guzzle before 7.14.2 allows origin servers to receive proxy credentials
Host validation bypass in guzzlehttp/psr7 before 2.12.3 enables URI authority confusion attacks against PHP applications
Cookie domain suffix-matching bypass in Guzzle PHP HTTP client (prior to 7.12.3) allows cross-host cookie disclosure, co
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today