Guzzle HTTP EUVD-2026-51850

Three conditions must all be true simultaneously: (1) the application enables Guzzle's built-in cookie support by passing a CookieJar instance (or using the cookies request option), (2) the application sends a request to an attacker-controlled or compromised server and processes its response, and (3) the application retains or reuses the same CookieJar across subsequent requests to other hosts. Applications that do not use cookies (no CookieJar configured) are entirely unaffected. Applications using separate, per-origin jars are unaffected for the cross-domain vector but may still be affected by single-origin accumulation if the jar is reused across many responses from the same malicious host. Applications delegating to a third-party CookieJarInterface that enforces its own size limits are also not affected. The attacker must be positioned as - or have compromised - a server the application legitimately contacts; a purely passive network attacker cannot inject Set-Cookie headers without a man-in-the-middle position on a plaintext connection.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L) yields a score of 6.9, reflecting low-complexity network access with no privileges required but only low availability impact on the vulnerable system. Real-world risk is moderate: exploitation requires the application to actually receive a response from an attacker-controlled or compromised server, which is a meaningful precondition absent in read-only or strictly internal deployments. No CISA KEV listing and no confirmed public exploit code exist at time of analysis, which is consistent with a lower-urgency remediation window. The cross-subdomain scope vector (sibling host poisoning) elevates the real-world concern slightly beyond a simple self-DoS, as a single compromised third-party integration could disrupt unrelated services sharing a reused CookieJar. The CVSS VA:L rating may understate impact in applications where cookie accumulation causes sustained memory pressure or cascading request failures rather than a momentary blip.

An attacker operates or compromises a server that the target PHP application communicates with via Guzzle with cookie support enabled. The server responds with hundreds of Set-Cookie headers, each carrying a value close to or exceeding several kilobytes, which Guzzle stores without limit in the shared CookieJar. On the next request to any host matched by the stored cookies - including sibling subdomains via parent-domain cookies - Guzzle assembles a single Cookie header containing all accumulated values, producing a header that exceeds the limit of the downstream handler, proxy, or destination server, causing the request to fail or be silently truncated.