CVE-2026-67354

Name of the Vulnerable Software and Affected Versions guzzlehttp/guzzle versions prior to 7.15.1

Description An information disclosure issue exists in the RedirectMiddleware when the optional allow redirects.referer setting is enabled. During a same-scheme redirect (such as HTTPS to HTTPS), the middleware copies the URI fragment—the portion of the URI following the # symbol—into the generated Referer header. While URI fragments are typically handled locally by the client and not sent to the server in the initial request, this behavior allows a destination server controlling the redirect to read the fragment from the incoming header. This could lead to the disclosure of sensitive client data, such as access tokens, state values, or one-time login secrets. This issue affects both cURL and stream handlers. The referer setting is disabled by default.

Recommendations Update guzzlehttp/guzzle to version 7.15.1 or later. As a temporary workaround, ensure the allow redirects.referer setting is set to false. Alternatively, disable automatic redirects and follow trusted destinations manually, or remove the fragment from the request URI before sending a request that may redirect.