Fluid Attacks Database

Description

guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and generate oversized Cookie headers that fail in handlers or destination servers.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	guzzle	=7.11.0-1 \|\| =7.12.0-1 \|\| =7.12.1-1 \|\| =7.12.3-1 \|\| =7.13.1-1 \|\| =7.14.0-1 \|\| =7.14.1-1 \|\| =7.14.2-1 \|\| =7.15.0-1 \|\| =7.15.1-1 \|\| =7.15.2-1 \|\| =7.15.3-1 \|\| =7.15.5-1 \|\| =7.4.5-1 \|\| =7.9.2-0.1 \|\| =8.0.1-1 \|\| =8.0.2-1 \|\| =8.1.0-1 \|\| =8.2.0-1	-
packagist	guzzlehttp/guzzle	>=0 <7.15.1	7.15.1
debian 13	guzzle	=7.11.0-1 \|\| =7.12.0-1 \|\| =7.12.1-1 \|\| =7.12.3-1 \|\| =7.13.1-1 \|\| =7.14.0-1 \|\| =7.14.1-1 \|\| =7.14.2-1 \|\| =7.15.0-1 \|\| =7.15.1-1 \|\| =7.15.2-1 \|\| =7.15.3-1 \|\| =7.15.5-1 \|\| =7.9.2-0.1 \|\| =8.0.1-1 \|\| =8.0.2-1 \|\| =8.1.0-1 \|\| =8.2.0-1	-
debian 14	guzzle	=7.11.0-1 \|\| =7.12.0-1 \|\| =7.12.1-1 \|\| =7.12.3-1 \|\| =7.13.1-1 \|\| =7.14.0-1 \|\| =7.14.1-1 \|\| =7.14.2-1 \|\| =7.15.0-1 \|\| =7.9.2-0.1 \|\| >=0 <7.15.1-1	7.15.1-1

Aliases

1. CVE-2026-673532. NVD-2026-673533. OSV-DEBIAN-2026-673534. OSV-2026-673535. GHSA-f283-ghqc-fg796. GCVE-2026-673537. SECURITY-TRACKER-CVE-2026-67353

References

1. https://github.com/guzzle/guzzle/security/advisories/GHSA-f283-ghqc-fg792. https://github.com/guzzle/guzzle/pull/39013. https://github.com/guzzle/guzzle/commit/7b68220d6543f6f80fe62e633361fc9d4ead14d44. https://github.com/guzzle/guzzle/releases/tag/7.15.15. https://www.vulncheck.com/advisories/guzzlehttp-guzzle-before-unbounded-cookie-denial-of-service

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.