# CVE-2026-67354: Guzzle URI fragment disclosure in redirect Referer header

Source: https://junglewise.ai/threats/cve-2026-67354-guzzle-uri-fragment-disclosure-in-redirect-referer-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-67354 · Severity: medium · CVSS 5.9 · Published 2026-08-01

Guzzle is a popular PHP HTTP client library used by millions of web applications. When a site uses Guzzle's automatic redirect-following feature with the optional Referer header enabled, sensitive data stored in URL fragments (like login tokens or access codes) can be inadvertently leaked to untrusted servers during redirects. An attacker controlling a redirect destination could capture this leaked data from server logs or application code, potentially compromising user accounts or sessions.

Technologies: [Guzzle](https://junglewise.ai/threats/technologies/guzzle), [guzzlehttp/guzzle (Packagist)](https://junglewise.ai/threats/technologies/guzzlehttp-guzzle). Vendors: [Guzzle](https://junglewise.ai/threats/vendors/guzzle), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-67354 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67354 being exploited in the wild.

**How severe is CVE-2026-67354?** Medium severity, with a CVSS score of 5.9, published 1 August 2026.

**Which products and versions are affected?** Guzzle before 7.15.1; guzzlehttp/guzzle (Packagist) ECOSYSTEM:introduced=0,fixed=7.15.1.

**Is there a fix for CVE-2026-67354?** Yes. guzzlehttp/guzzle (Packagist): upgrade to 7.15.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67354 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-67354?** Check whether you run Guzzle or guzzlehttp/guzzle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- guzzlehttp/guzzle (Packagist): upgrade to 7.15.1 or later

  ```sh
  composer require guzzlehttp/guzzle:^7.15.1
  ```


## Technical details

The vulnerability is an information disclosure issue (CWE-201/CWE-212) in Guzzle's RedirectMiddleware component. When allow_redirects.referer is enabled and a same-scheme redirect occurs (e.g., HTTPS→HTTPS), the middleware incorrectly includes the URI fragment from the original request in the generated Referer header sent to the redirect destination. Fragments are normally client-side only and never transmitted to servers, so the redirect destination server should never receive them. Attack requires: (1) application enables allow_redirects.referer option (disabled by default), (2) user makes a request with sensitive data in the URI fragment, and (3) the request redirects to a same-scheme destination. Fixed in version 7.15.1, which strips fragments before generating the Referer value. Both cURL and stream handlers are affected.

## Affected products

- Guzzle Guzzle before 7.15.1

## Identifiers

- CVE-2026-67354
- GHSA-h95v-h523-3mw8

## Timeline

- 2026-07-18: disclosed: GitHub Security Advisory GHSA-h95v-h523-3mw8 published
- 2026-07-18: patched: Version 7.15.1 released with fix
- 2026-08-01: advisory: CVE-2026-67354 published on NVD

## References

- [https://github.com/guzzle/guzzle/security/advisories/GHSA-h95v-h523-3mw8](https://github.com/guzzle/guzzle/security/advisories/GHSA-h95v-h523-3mw8)
- [https://www.vulncheck.com/advisories/guzzlehttp-guzzle-before-uri-fragment-disclosure-via-referer](https://www.vulncheck.com/advisories/guzzlehttp-guzzle-before-uri-fragment-disclosure-via-referer)

## Related threats

- [Guzzle noncanonical host bypass in URI handlers](https://junglewise.ai/threats/cve-2026-69246-guzzle-noncanonical-host-bypass-in-uri-handlers)
- [Guzzle incorrect cookie domain matching for noncanonical IP addresses](https://junglewise.ai/threats/cve-2026-69245-guzzle-incorrect-cookie-domain-matching-for-noncanonical-ip)
- [Guzzle GuzzleHTTP host-only cookie scope disclosure](https://junglewise.ai/threats/guzzle-guzzlehttp-host-only-cookie-scope-disclosure-958db8d5)
- [Guzzle information disclosure in RedirectMiddleware Referer headers](https://junglewise.ai/threats/guzzle-information-disclosure-in-redirectmiddleware-referer-headers-d2e711b6)
- [Guzzle unbounded response cookies denial of service in CookieJar](https://junglewise.ai/threats/guzzle-unbounded-response-cookies-denial-of-service-in-cookiejar-f650c2bc)