Executive brief
Guzzle, a popular PHP HTTP client library, contains a flaw that can leak sensitive information during web redirects. When a specific optional setting is enabled, the library may include private data from a web address (like access tokens or login secrets) in headers sent to a new destination. An attacker who controls a redirect destination could capture this sensitive information, potentially leading to account takeover or data theft.
Technical details
An information disclosure vulnerability exists in Guzzle's RedirectMiddleware (versions < 7.15.1) when the optional 'allow_redirects.referer' setting is enabled. The middleware incorrectly includes the URI fragment (the portion after the '#') in the generated Referer header when following same-scheme redirects (e.g., HTTPS to HTTPS). While fragments are normally handled locally by clients and omitted from HTTP requests, Guzzle's reintroduction of them allows a malicious redirect destination to capture sensitive data such as OAuth tokens or session states. The vulnerability is exploitable if an application uses sensitive fragments and follows a redirect to an untrusted server. This is fixed in version 7.15.1 by stripping fragments before header generation.
Affected products
- guzzlehttp guzzle < 7.15.1
Timeline
- 2026-07-18: advisory: Original GHSA-h95v-h523-3mw8 published
- 2026-08-01: disclosed: CVE-2026-67354 published
- 2026-08-04: other: Duplicate advisory GHSA-mqq9-gxg5-m58g withdrawn