CVE-2026-67354
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
guzzlehttp/guzzle before version 7.15.1 contains an information disclosure vulnerability in RedirectMiddleware. When the optional allow_redirects.referer setting is enabled, the middleware copies the URI fragment from the referring request into the Referer header during a redirect. An attacker controlling the redirect destination can read this fragment, potentially disclosing one-time login secrets, access tokens, and other sensitive data.
Risk Assessment
An attacker can intercept sensitive data such as access tokens, potentially leading to unauthorized access to accounts and data.
Recommendation
Update guzzlehttp/guzzle to version 7.15.1 or later, and consider disabling the allow_redirects.referer setting if not needed.
Other vulnerabilities in guzzlehttp/guzzle
See all- CVE-2026-67355Medium
guzzlehttp/guzzle before version 7.15.1 fails to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session identifiers and authorization tokens.
- CVE-2026-67353Medium
guzzlehttp/guzzle before version 7.15.1 contains a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and generate oversized Cookie headers that fail in handlers or destination servers.
Original NVD description (English source)
guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allow_redirects.referer setting is enabled, the middleware copies the URI fragment (the portion after '#') from the referring request into the generated Referer header when following a same-scheme redirect (e.g., HTTPS to HTTPS). An attacker who controls the redirect destination can read this fragment from the incoming Referer header, potentially disclosing one-time login secrets, access tokens, state values, or other sensitive client data to a server never meant to receive it. The referer setting is disabled by default. Fixed in 7.15.1, which strips the fragment before generating the Referer value.