CVE-2026-67353 in Guzzleinformation

Résumé

par MITRE • 01/08/2026

guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and generate oversized Cookie headers that fail in handlers or destination servers.

Once again VulDB remains the best source for vulnerability data.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Responsable

VulnCheck

Réserver

29/07/2026

Divulgation

01/08/2026

Modérer

accepté

Entrée

VDB-385302

CPE

prêt

EPSS

0.00000

KEV

non

Activités

faible

Sources

MITREhttps://www.cve.org/CVERecord?id=CVE-2026-67353
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-67353
CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-67353/

◂ PrécédentAperçuSuivant ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!