{"uuid": "ccbacf8c-23f0-4b95-831a-d8f9278c8334", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-32205", "type": "seen", "source": "https://gist.github.com/alon710/2702abf20f9326c55748b684ae709cc9", "content": "# GHSA-F283-GHQC-FG79: GHSA-f283-ghqc-fg79: Denial of Service via Unbounded Cookie Jar Resource Exhaustion in Guzzle\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/GHSA-F283-GHQC-FG79\n\n## Summary\nAn unbounded resource allocation vulnerability exists in Guzzle's cookie parsing and storage engine. Prior to version 7.15.1, Guzzle did not restrict the number or size of cookies stored within the client-side CookieJar. This lack of boundary control allows a malicious server or an intermediary proxy to poison the cookie storage with oversized or excessive Set-Cookie headers. When the client subsequently targets sibling domains or legitimate services using the same cookie jar, it transmits exceptionally large Cookie headers, triggering upstream protocol violations and resulting in Denial of Service (HTTP 431 / HTTP 400 rejection).\n\n## TL;DR\nUnbounded memory and cookie header limits in Guzzle allow malicious web servers to poison client cookie jars, causing subsequent outgoing requests to be rejected with HTTP 431/400 errors, leading to a denial of service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network\n- **CVSS**: 5.3\n- **EPSS**: N/A\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- PHP installations using Composer applications importing Guzzle client library\n- Symfony/Laravel/Drupal sites relying on Guzzle's CookieJar implementation for request state synchronization\n- **guzzle**: < 7.15.1 (Fixed in: `7.15.1`)\n\n## Mitigation\n\n- Upgrade Guzzle to version 7.15.1 or later\n- Disable cookie handling for connections to untrusted endpoints using ['cookies' => false]\n- Isolate cookie storage across multiple endpoints to avoid cross-domain/cross-service sibling poisoning\n- Implement a custom CookieJar wrapper that restricts the count and length of parsed cookies\n\n**Remediation Steps:**\n1. Run 'composer update guzzlehttp/guzzle' to fetch the latest secure version\n2. Verify Guzzle lock file shows version 7.15.1 or newer\n3. Ensure persistent cookie storage files (FileCookieJar/SessionCookieJar) are purged after the upgrade as the serialization format includes the mandatory 'HostOnly' flag and will raise RuntimeExceptions for legacy unflagged cookies\n\n## References\n\n- [GHSA-f283-ghqc-fg79 Security Advisory](https://github.com/guzzle/guzzle/security/advisories/GHSA-f283-ghqc-fg79)\n- [Fix Commit 7b68220d6543f6f80fe62e633361fc9d4ead14d4](https://github.com/guzzle/guzzle/commit/7b68220d6543f6f80fe62e633361fc9d4ead14d4)\n- [Related curl Denial of Service Advisory](https://curl.se/docs/CVE-2022-32205.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-F283-GHQC-FG79) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T02:31:08.204716Z"}