Is CVE-2026-67354 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67354 being exploited in the wild.

How severe is CVE-2026-67354?

Medium severity, with a CVSS score of 5.9, published 1 August 2026.

Which products and versions are affected?

Guzzle before 7.15.1; guzzlehttp/guzzle (Packagist) ECOSYSTEM:introduced=0,fixed=7.15.1.

Is there a fix for CVE-2026-67354?

Yes. guzzlehttp/guzzle (Packagist): upgrade to 7.15.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67354 attacked?

It is attacked over the network.

Am I affected by CVE-2026-67354?

Check whether you run Guzzle or guzzlehttp/guzzle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67354: Guzzle URI fragment disclosure in redirect Referer header

CVE-2026-67354 · Severity: medium · CVSS 5.9 · Published 2026-08-01

Guzzle is a popular PHP HTTP client library used by millions of web applications. When a site uses Guzzle's automatic redirect-following feature with the optional Referer header enabled, sensitive data stored in URL fragments (like login tokens or access codes) can be inadvertently leaked to untrusted servers during redirects. An attacker controlling a redirect destination could capture this leaked data from server logs or application code, potentially compromising user accounts or sessions.

Technologies: Guzzle, guzzlehttp/guzzle (Packagist). Vendors: Guzzle, Packagist.

Quick answers

Is CVE-2026-67354 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67354 being exploited in the wild.
How severe is CVE-2026-67354?: Medium severity, with a CVSS score of 5.9, published 1 August 2026.
Which products and versions are affected?: Guzzle before 7.15.1; guzzlehttp/guzzle (Packagist) ECOSYSTEM:introduced=0,fixed=7.15.1.
Is there a fix for CVE-2026-67354?: Yes. guzzlehttp/guzzle (Packagist): upgrade to 7.15.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67354 attacked?: It is attacked over the network.
Am I affected by CVE-2026-67354?: Check whether you run Guzzle or guzzlehttp/guzzle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

guzzlehttp/guzzle (Packagist): upgrade to 7.15.1 or later
```
composer require guzzlehttp/guzzle:^7.15.1
```

Technical details

The vulnerability is an information disclosure issue (CWE-201/CWE-212) in Guzzle's RedirectMiddleware component. When allow_redirects.referer is enabled and a same-scheme redirect occurs (e.g., HTTPS→HTTPS), the middleware incorrectly includes the URI fragment from the original request in the generated Referer header sent to the redirect destination. Fragments are normally client-side only and never transmitted to servers, so the redirect destination server should never receive them. Attack requires: (1) application enables allow_redirects.referer option (disabled by default), (2) user makes a request with sensitive data in the URI fragment, and (3) the request redirects to a same-scheme destination. Fixed in version 7.15.1, which strips fragments before generating the Referer value. Both cURL and stream handlers are affected.

Affected products

Guzzle Guzzle before 7.15.1

Identifiers

CVE-2026-67354
GHSA-h95v-h523-3mw8

Timeline

2026-07-18: disclosed: GitHub Security Advisory GHSA-h95v-h523-3mw8 published
2026-07-18: patched: Version 7.15.1 released with fix
2026-08-01: advisory: CVE-2026-67354 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.