Executive brief
Guzzle, a popular PHP library for making web requests, contains a flaw where sensitive information in a web address (URI) can be accidentally shared with third-party servers. When the library follows a redirect, it may include private data—such as login tokens or secret keys stored in the 'fragment' part of the URL—in the 'Referer' header sent to the new destination. This could allow an attacker who controls a redirected-to website to steal sensitive user credentials or session data.
Technical details
A vulnerability in Guzzle's RedirectMiddleware causes URI fragments (the portion of a URL after the '#') to be included in the 'Referer' header during redirects. While fragments are normally handled locally by clients and excluded from HTTP requests, Guzzle's middleware may reintroduce them when following a redirect to a destination using the same URI scheme (e.g., HTTPS to HTTPS). If an application has 'allow_redirects.referer' enabled and includes sensitive data like access tokens or state values in URI fragments, that data is disclosed to the redirect destination. This affects both cURL and stream handlers. The issue is resolved in version 7.15.1 by ensuring fragments are stripped before header generation.
Affected products
- GuzzleHTTP guzzle < 7.15.1
Timeline
- 2026-07-18: disclosed: Initial publication by maintainer
- 2026-07-20: advisory: GitHub Advisory published
- 2026-07-15: patched: Version 7.15.1 released
References
- https://api.github.com/users/GrahamCampbell
- https://github.com/GrahamCampbell
- https://api.github.com/users/GrahamCampbell/gists%7B/gist_id%7D
- https://api.github.com/users/GrahamCampbell/repos
- https://avatars.githubusercontent.com/u/2829600?v=4
- https://api.github.com/users/GrahamCampbell/events%7B/privacy%7D