DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-F283-GHQC-FG79: GHSA-f283-ghqc-fg79: Denial of Service via Unbounded Cookie Jar Resource Exhaustion in Guzzle

#security #cve #cybersecurity #ghsa

GHSA-f283-ghqc-fg79: Denial of Service via Unbounded Cookie Jar Resource Exhaustion in Guzzle

Vulnerability ID: GHSA-F283-GHQC-FG79
CVSS Score: 5.3
Published: 2026-07-20

An unbounded resource allocation vulnerability exists in Guzzle's cookie parsing and storage engine. Prior to version 7.15.1, Guzzle did not restrict the number or size of cookies stored within the client-side CookieJar. This lack of boundary control allows a malicious server or an intermediary proxy to poison the cookie storage with oversized or excessive Set-Cookie headers. When the client subsequently targets sibling domains or legitimate services using the same cookie jar, it transmits exceptionally large Cookie headers, triggering upstream protocol violations and resulting in Denial of Service (HTTP 431 / HTTP 400 rejection).

TL;DR

Unbounded memory and cookie header limits in Guzzle allow malicious web servers to poison client cookie jars, causing subsequent outgoing requests to be rejected with HTTP 431/400 errors, leading to a denial of service.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-770
  • Attack Vector: Network
  • CVSS: 5.3
  • EPSS: N/A
  • Impact: Denial of Service (DoS)
  • Exploit Status: Proof of Concept
  • KEV Status: Not Listed

Affected Systems

  • PHP installations using Composer applications importing Guzzle client library
  • Symfony/Laravel/Drupal sites relying on Guzzle's CookieJar implementation for request state synchronization
  • guzzle: < 7.15.1 (Fixed in: 7.15.1)

Code Analysis

Commit: 7b68220

Introduce limits to cookie header extraction and outbound assembly

Exploit Details

  • GitHub Security Advisory Tests: Verification test cases that reproduce the DoS behavior by mocking HTTP responses containing more than 50 Set-Cookie values or oversized Set-Cookie headers.

Mitigation Strategies

  • Upgrade Guzzle to version 7.15.1 or later
  • Disable cookie handling for connections to untrusted endpoints using ['cookies' => false]
  • Isolate cookie storage across multiple endpoints to avoid cross-domain/cross-service sibling poisoning
  • Implement a custom CookieJar wrapper that restricts the count and length of parsed cookies

Remediation Steps:

  1. Run 'composer update guzzlehttp/guzzle' to fetch the latest secure version
  2. Verify Guzzle lock file shows version 7.15.1 or newer
  3. Ensure persistent cookie storage files (FileCookieJar/SessionCookieJar) are purged after the upgrade as the serialization format includes the mandatory 'HostOnly' flag and will raise RuntimeExceptions for legacy unflagged cookies

References

Read the full report for GHSA-F283-GHQC-FG79 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)