CVE-2026-67353 guzzle CVE debrief

Who should care

Users of guzzlehttp/guzzle versions before 7.15.1 should assess exposure and apply remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review the affected product context and defensive impact. They should also verify the presence of vulnerable versions and apply vendor remediation if available.

Technical summary

guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. This could allow attackers to return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and generate oversized Cookie headers that fail in handlers or destination servers. The vulnerability has a CVSS score of 6.9 and a severity of MEDIUM.

Defensive priority

Medium-priority defensive actions are recommended due to the potential for denial of service attacks.

Recommended defensive actions

• Inventory and verify versions of guzzlehttp/guzzle in use
• Assess exposure based on primary official records
• Apply vendor remediation if available
• Monitor for potential denial of service attacks
• Implement compensating controls as needed
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The evidence for this CVE is limited. The CVE record was published on 2026-08-01T13:17:06.000Z and has not been modified since then. Verify vulnerable versions of guzzlehttp/guzzle and assess exposure based on primary official records. Check for large Set-Cookie header fields with no size restrictions in the CookieJar that could lead to denial of service attacks. Defenders should verify the presence of guzzlehttp/guzzle versions before 7.15.1 and apply remediation if available.

Official resources