CVE-2026-67353 guzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of Service

guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and...

CVE-2026-67353

Affected software: guzzlehttp/guzzle prior to 7.15.1. Issue: a denial-of-service vulnerability in CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions, enabling an attacker to return many large cookies and cause excessive in-memory data and oversized Cookie headers ...

CVE-2026-35457

libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, the rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory growth. This vulnerability is fixed i...

GHSA-V5HW-CV9C-RPG7 libp2p-rendezvous: Unbounded rendezvous DISCOVER cookies enable remote memory exhaustion

Summary The rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory growth. Details Pagination state is stored in: rs HashMap On Message::Discover: remote peer → DISCOVER → handlerequest →...