CVE-2026-67354 Details
Description
guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allow_redirects.referer setting is enabled, the middleware copies the URI fragment (the portion after '#') from the referring request into the generated Referer header when following a same-scheme redirect (e.g., HTTPS to HTTPS). An attacker who controls the redirect destination can read this fragment from the incoming Referer header, potentially disclosing one-time login secrets, access tokens, state values, or other sensitive client data to a server never meant to receive it. The referer setting is disabled by default. Fixed in 7.15.1, which strips the fragment before generating the Referer value.
A vulnerability allowing information disclosure has been identified in GuzzleHTTP Guzzle versions prior to 7.15.1, specifically within the RedirectMiddleware component. When the optional allow_redirects.referer setting is activated, the middleware can inadvertently include the URI fragment from the referring request into the Referer header during same-scheme redirects (e.g., HTTPS to HTTPS). This behavior allows an attacker controlling the redirect destination to access sensitive information such as one-time login secrets, access tokens, state values, or other private client data from a server that was not intended to receive it. The referer setting is off by default, and applications not following redirects or only redirecting within the same trust boundary are not affected.
Users can upgrade to GuzzleHTTP Guzzle version 7.15.1 or later, which addresses the vulnerability by removing the URI fragment from the Referer header before following redirects. If an immediate upgrade is not possible, the referer setting can be disabled or set to false when configuring redirect options.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-201 | Insertion of Sensitive Information Into Sent Data | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 1, 2026 | New CVE Received | [email protected] |