CVE-2026-67353
Description
A flaw was found in guzzlehttp/guzzle. A remote attacker can exploit this vulnerability by sending an excessive number of large 'Set-Cookie' header fields from a malicious server. This causes the application's CookieJar to store an unbounded amount of data in memory, leading to resource exhaustion. The consequence is a Denial of Service (DoS), where the application becomes unresponsive or crashes due to excessive memory consumption and oversized cookie headers.
Statement
Community packages in Fedora and EPEL that bundle guzzlehttp/guzzle (nextcloud, roundcubemail) already ship patched versions (7.15.2 and 7.15.3 respectively) that include the fix for this vulnerability, and are therefore not affected.
Mitigation
Upgrade guzzlehttp/guzzle to version 7.15.1 or later.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
