CVE-2026-67354: Guzzle Information Disclosure Vulnerability

CVE-2026-67354 Overview

CVE-2026-67354 is an information disclosure vulnerability in the guzzlehttp/guzzle HTTP client library affecting versions before 7.15.1. The flaw resides in RedirectMiddleware, which copies the URI fragment from a referring request into the generated Referer header when following a same-scheme redirect. When the optional allow_redirects.referer setting is enabled, an attacker controlling the redirect destination can read the fragment from the incoming Referer header. Disclosed data may include one-time login secrets, access tokens, or state values intended to remain client-side. The vulnerability maps to [CWE-201: Insertion of Sensitive Information Into Sent Data].

Critical Impact
Fragment-based secrets such as OAuth tokens and login codes can leak to attacker-controlled endpoints during HTTPS-to-HTTPS redirects when the referer option is enabled.

Affected Products

guzzlehttp/guzzle versions prior to 7.15.1
Applications using RedirectMiddleware with allow_redirects.referer enabled
Downstream PHP projects bundling vulnerable Guzzle releases

Discovery Timeline

2026-08-01 - CVE-2026-67354 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67354

Vulnerability Analysis

Guzzle's RedirectMiddleware optionally generates a Referer header when following redirects. The middleware constructs this header from the previous request URI without stripping the fragment component. URI fragments (the portion after #) are conventionally client-side data and are never transmitted by browsers in outbound HTTP requests. Guzzle's behavior diverges from that expectation, sending fragment contents to the redirect target.

When an application uses fragments to carry sensitive values, such as OAuth 2.0 implicit-flow access tokens, single-use login codes, or CSRF state parameters, the middleware exposes those values to any server capable of serving a redirect. The allow_redirects.referer option is disabled by default, limiting the exposed population to applications that explicitly opted in.

Root Cause

The root cause is missing fragment sanitization in the referer-generation logic of RedirectMiddleware. The middleware passes the full URI, including its fragment, into the Referer value for same-scheme redirects (for example, HTTPS to HTTPS). Version 7.15.1 remediates the issue by stripping the fragment before constructing the header.

Attack Vector

An attacker sets up a URL that redirects to an endpoint they control. A victim application configured with allow_redirects.referer => true issues an HTTPS request to a URL containing fragment data, such as https://app.example.com/callback#access_token=.... Guzzle follows the redirect and populates the outgoing Referer header with the full URI, fragment included. The attacker's server logs the header and extracts the secret. Exploitation requires that the target application both enables the referer setting and passes sensitive data in fragments.

The vulnerability is described in the GitHub Security Advisory GHSA-h95v-h523-3mw8 and the VulnCheck Advisory.

Detection Methods for CVE-2026-67354

Indicators of Compromise

Outbound HTTP requests where the Referer header contains # followed by token-like values such as access_token=, id_token=, code=, or state=.
Web server access logs on attacker-controlled or third-party hosts recording Referer values with fragment content originating from PHP User-Agents.
Application dependency manifests (composer.lock) listing guzzlehttp/guzzle at a version below 7.15.1.

Detection Strategies

Inventory PHP projects and scan composer.lock files for guzzlehttp/guzzle versions earlier than 7.15.1.
Search source code for allow_redirects configurations containing a referer key set to true.
Inspect proxy or egress logs for outbound Referer headers carrying fragment components from PHP-based clients.

Monitoring Recommendations

Enable HTTP egress logging on application servers and alert on Referer values containing # characters.
Route external HTTP traffic from PHP workloads through an inspecting proxy that can strip fragments from Referer headers.
Add composer audit checks to CI/CD pipelines to fail builds that resolve Guzzle to a vulnerable version.

How to Mitigate CVE-2026-67354

Immediate Actions Required

Upgrade guzzlehttp/guzzle to version 7.15.1 or later across all PHP applications and dependencies.
Audit code for allow_redirects options and disable the referer flag where it is not required.
Rotate any secrets, tokens, or one-time codes that may have transited fragments while the referer option was enabled.

Patch Information

The maintainers fixed the issue in Guzzle 7.15.1 by stripping the URI fragment before generating the Referer header. Details are published in the GitHub Security Advisory GHSA-h95v-h523-3mw8. Upgrade using composer update guzzlehttp/guzzle and verify the resolved version in composer.lock.

Workarounds

Set allow_redirects.referer to false in all Guzzle client configurations until the upgrade is complete.
Avoid storing sensitive values in URI fragments passed to Guzzle-based HTTP clients.
Use an egress proxy or middleware wrapper that removes fragments from any URL supplied to RedirectMiddleware.

bash

# Upgrade to the patched release
composer require guzzlehttp/guzzle:^7.15.1
composer update guzzlehttp/guzzle

# Verify installed version
composer show guzzlehttp/guzzle | grep versions