CVE-2026-67354
Received Received - Intake

Information Disclosure in GuzzleHTTP Guzzle via RedirectMiddleware

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allow_redirects.referer setting is enabled, the middleware copies the URI fragment (the portion after '#') from the referring request into the generated Referer header when following a same-scheme redirect (e.g., HTTPS to HTTPS). An attacker who controls the redirect destination can read this fragment from the incoming Referer header, potentially disclosing one-time login secrets, access tokens, state values, or other sensitive client data to a server never meant to receive it. The referer setting is disabled by default. Fixed in 7.15.1, which strips the fragment before generating the Referer value.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-67354
EUVD
EUVD-2026-51825

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
guzzlehttp guzzle to 7.15.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-201 The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects guzzlehttp/guzzle versions before 7.15.1. When the allow_redirects.referer setting is enabled, the RedirectMiddleware copies the URI fragment (text after #) from the referring request into the Referer header during same-scheme redirects. Attackers controlling the redirect destination can read this fragment, potentially exposing sensitive client data like tokens or secrets.

Detection Guidance

Check if your system uses guzzlehttp/guzzle versions before 7.15.1 by running: composer show guzzlehttp/guzzle. If the version is below 7.15.1, the system is vulnerable. Inspect HTTP traffic for Referer headers containing URI fragments after redirects, especially when allow_redirects.referer is enabled.

Impact Analysis

If you use a vulnerable version of guzzlehttp/guzzle with the allow_redirects.referer setting enabled, attackers could intercept sensitive data like one-time login secrets, access tokens, or state values via URI fragments disclosed in Referer headers during redirects.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) by exposing personal or confidential information to unintended servers.

Mitigation Strategies

Upgrade guzzlehttp/guzzle to version 7.15.1 or later. If upgrading is not immediately possible, disable the allow_redirects.referer setting in your application configuration to prevent fragment leakage in Referer headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67354. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart