{"vulnerability": "CVE-2022-32205", "sightings": [{"uuid": "cea2da52-c968-4f5f-927d-684a6ae59658", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-32205", "type": "seen", "source": "https://gist.github.com/Darkcrai86/2e565b4e81ab23e6d6e02c3838eced99", "content": "", "creation_timestamp": "2025-09-29T16:01:12.000000Z"}, {"uuid": "94aab014-7b07-42ef-b19f-3450d7b510fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-32205", "type": "seen", "source": "https://t.me/ctinow/54471", "content": "Internet Bug Bounty: CVE-2022-32205: Set-Cookie denial of service\n\nhttps://ift.tt/Vdxe7s1", "creation_timestamp": "2022-06-27T23:06:36.000000Z"}, {"uuid": "c20a7778-c46b-497a-ae09-26351eb632b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-32205", "type": "seen", "source": "https://t.me/cibsecurity/45733", "content": "\u203c CVE-2022-32205 \u203c\n\nA malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a \"sister server\" to effectively cause a denial of service for a sibling site on the same second level domain using this method.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-07-07T16:15:22.000000Z"}, {"uuid": "ccbacf8c-23f0-4b95-831a-d8f9278c8334", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-32205", "type": "seen", "source": "https://gist.github.com/alon710/2702abf20f9326c55748b684ae709cc9", "content": "# GHSA-F283-GHQC-FG79: GHSA-f283-ghqc-fg79: Denial of Service via Unbounded Cookie Jar Resource Exhaustion in Guzzle\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/GHSA-F283-GHQC-FG79\n\n## Summary\nAn unbounded resource allocation vulnerability exists in Guzzle's cookie parsing and storage engine. Prior to version 7.15.1, Guzzle did not restrict the number or size of cookies stored within the client-side CookieJar. This lack of boundary control allows a malicious server or an intermediary proxy to poison the cookie storage with oversized or excessive Set-Cookie headers. When the client subsequently targets sibling domains or legitimate services using the same cookie jar, it transmits exceptionally large Cookie headers, triggering upstream protocol violations and resulting in Denial of Service (HTTP 431 / HTTP 400 rejection).\n\n## TL;DR\nUnbounded memory and cookie header limits in Guzzle allow malicious web servers to poison client cookie jars, causing subsequent outgoing requests to be rejected with HTTP 431/400 errors, leading to a denial of service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network\n- **CVSS**: 5.3\n- **EPSS**: N/A\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- PHP installations using Composer applications importing Guzzle client library\n- Symfony/Laravel/Drupal sites relying on Guzzle's CookieJar implementation for request state synchronization\n- **guzzle**: < 7.15.1 (Fixed in: `7.15.1`)\n\n## Mitigation\n\n- Upgrade Guzzle to version 7.15.1 or later\n- Disable cookie handling for connections to untrusted endpoints using ['cookies' => false]\n- Isolate cookie storage across multiple endpoints to avoid cross-domain/cross-service sibling poisoning\n- Implement a custom CookieJar wrapper that restricts the count and length of parsed cookies\n\n**Remediation Steps:**\n1. Run 'composer update guzzlehttp/guzzle' to fetch the latest secure version\n2. Verify Guzzle lock file shows version 7.15.1 or newer\n3. Ensure persistent cookie storage files (FileCookieJar/SessionCookieJar) are purged after the upgrade as the serialization format includes the mandatory 'HostOnly' flag and will raise RuntimeExceptions for legacy unflagged cookies\n\n## References\n\n- [GHSA-f283-ghqc-fg79 Security Advisory](https://github.com/guzzle/guzzle/security/advisories/GHSA-f283-ghqc-fg79)\n- [Fix Commit 7b68220d6543f6f80fe62e633361fc9d4ead14d4](https://github.com/guzzle/guzzle/commit/7b68220d6543f6f80fe62e633361fc9d4ead14d4)\n- [Related curl Denial of Service Advisory](https://curl.se/docs/CVE-2022-32205.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-F283-GHQC-FG79) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T02:31:08.204716Z"}]}