# Guzzle information disclosure in RedirectMiddleware Referer headers

Source: https://junglewise.ai/threats/guzzle-information-disclosure-in-redirectmiddleware-referer-headers-d2e711b6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-01. Updated: 2026-08-04  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 5.9 · Published 2026-08-01

Guzzle, a popular PHP HTTP client library, contains a flaw that can leak sensitive information during web redirects. When a specific optional setting is enabled, the library may include private data from a web address (like access tokens or login secrets) in headers sent to a new destination. An attacker who controls a redirect destination could capture this sensitive information, potentially leading to account takeover or data theft.

Technologies: [Guzzle](https://junglewise.ai/threats/technologies/guzzle), [guzzlehttp/guzzle (Packagist)](https://junglewise.ai/threats/technologies/guzzlehttp-guzzle). Vendors: [Guzzle](https://junglewise.ai/threats/vendors/guzzle), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 5.9, published 1 August 2026.

**Which products and versions are affected?** Guzzle < 7.15.1; guzzlehttp/guzzle (Packagist) < 7.15.1.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Guzzle or guzzlehttp/guzzle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability exists in Guzzle's RedirectMiddleware (versions < 7.15.1) when the optional 'allow_redirects.referer' setting is enabled. The middleware incorrectly includes the URI fragment (the portion after the '#') in the generated Referer header when following same-scheme redirects (e.g., HTTPS to HTTPS). While fragments are normally handled locally by clients and omitted from HTTP requests, Guzzle's reintroduction of them allows a malicious redirect destination to capture sensitive data such as OAuth tokens or session states. The vulnerability is exploitable if an application uses sensitive fragments and follows a redirect to an untrusted server. This is fixed in version 7.15.1 by stripping fragments before header generation.

## Affected products

- guzzlehttp guzzle < 7.15.1

## Timeline

- 2026-07-18: advisory: Original GHSA-h95v-h523-3mw8 published
- 2026-08-01: disclosed: CVE-2026-67354 published
- 2026-08-04: other: Duplicate advisory GHSA-mqq9-gxg5-m58g withdrawn

## References

- [https://github.com/guzzle/guzzle/security/advisories/GHSA-h95v-h523-3mw8](https://github.com/guzzle/guzzle/security/advisories/GHSA-h95v-h523-3mw8)
- [https://www.vulncheck.com/advisories/guzzlehttp-guzzle-before-uri-fragment-disclosure-via-referer](https://www.vulncheck.com/advisories/guzzlehttp-guzzle-before-uri-fragment-disclosure-via-referer)

## Related threats

- [Guzzle noncanonical host bypass in URI handlers](https://junglewise.ai/threats/cve-2026-69246-guzzle-noncanonical-host-bypass-in-uri-handlers)
- [Guzzle incorrect cookie domain matching for noncanonical IP addresses](https://junglewise.ai/threats/cve-2026-69245-guzzle-incorrect-cookie-domain-matching-for-noncanonical-ip)
- [Guzzle GuzzleHTTP host-only cookie scope disclosure](https://junglewise.ai/threats/guzzle-guzzlehttp-host-only-cookie-scope-disclosure-958db8d5)
- [Guzzle unbounded response cookies denial of service in CookieJar](https://junglewise.ai/threats/guzzle-unbounded-response-cookies-denial-of-service-in-cookiejar-f650c2bc)
- [Guzzle Proxy-Authorization header disclosure to origin servers](https://junglewise.ai/threats/guzzle-proxy-authorization-header-disclosure-to-origin-servers-7a8a6575)