CyberRota Analysis
AI-GeneratedVersions of guzzlehttp/guzzle prior to 7.15.1 are vulnerable to a denial of service due to the CookieJar's lack of size restrictions on Set-Cookie header fields. This flaw allows attackers to exploit the library by sending numerous large cookies, leading to excessive memory consumption and potential failures in handling oversized Cookie headers. Organizations using affected versions should prioritize updating to mitigate the risk of service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and generate oversized Cookie headers that fail in handlers or destination servers.