CVE-2026-67353: falha de média gravidade em guzzle
guzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of Service
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.4%
guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and generate oversized Cookie headers that fail in handlers or destination servers.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Produtos afetados
guzzle · guzzleCVEs relacionadas — guzzle
No mesmo produto, das mais perigosas para as menos.
CVE-2022-31043HIGHFix failure to strip Authorization header on HTTP downgrade in GuzzleEPSS 2.0%CVE-2022-31042HIGHFailure to strip the Cookie header on change in host or HTTP downgrade in GuzzleEPSS 2.0%CVE-2022-31090HIGHCURLOPT_HTTPAUTH option not cleared on change of origin in GuzzleEPSS 1.9%CVE-2022-31091HIGHChange in port should be considered a change in origin in GuzzleEPSS 1.6%CVE-2022-29248HIGHCross-domain cookie leakage in GuzzleEPSS 1.4%CVE-2026-67354HIGHguzzlehttp/guzzle before 7.15.1 URI Fragment Disclosure via RefererEPSS 0.4%