AIKIDO-2026-729784
guzzlehttp/guzzle is vulnerable to Denial of Service (DoS)
53
Medium Risk
This Affects:
guzzlehttp/guzzleTL;DR
The built-in CookieJar accepts any number of Set-Cookie fields from one response with no size limit, then copies every matching cookie into a single generated Cookie header on later requests. A malicious or compromised server can therefore force large in-memory cookie state and oversized request headers, increasing memory and CPU use or causing later requests to fail. The fix caps accepted field size and cookie count per response, and bounds the number of pairs and total length of the generated Cookie header.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application enables Guzzle cookie support against an attacker-controlled or untrusted response while retaining or reusing the jar.
Background info
guzzlehttp/guzzle is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 7.15.0.
How to fix this
Upgrade the guzzlehttp/guzzle library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant