Executive brief
Guzzle is a popular PHP HTTP client library used by millions of web applications. When a site uses Guzzle's automatic redirect-following feature with the optional Referer header enabled, sensitive data stored in URL fragments (like login tokens or access codes) can be inadvertently leaked to untrusted servers during redirects. An attacker controlling a redirect destination could capture this leaked data from server logs or application code, potentially compromising user accounts or sessions.
Technical details
The vulnerability is an information disclosure issue (CWE-201/CWE-212) in Guzzle's RedirectMiddleware component. When allow_redirects.referer is enabled and a same-scheme redirect occurs (e.g., HTTPS→HTTPS), the middleware incorrectly includes the URI fragment from the original request in the generated Referer header sent to the redirect destination. Fragments are normally client-side only and never transmitted to servers, so the redirect destination server should never receive them. Attack requires: (1) application enables allow_redirects.referer option (disabled by default), (2) user makes a request with sensitive data in the URI fragment, and (3) the request redirects to a same-scheme destination. Fixed in version 7.15.1, which strips fragments before generating the Referer value. Both cURL and stream handlers are affected.
Affected products
- Guzzle Guzzle before 7.15.1
Timeline
- 2026-07-18: disclosed: GitHub Security Advisory GHSA-h95v-h523-3mw8 published
- 2026-07-18: patched: Version 7.15.1 released with fix
- 2026-08-01: advisory: CVE-2026-67354 published on NVD