Insertion of Sensitive Information Into Sent Data in guzzle - CVE-2026-67354
Published: November 6, 2026
Vulnerability identifier: #VU159745
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-67354
CWE-ID: CWE-201
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to obtain sensitive URI fragments intended to remain private to the client.
The vulnerability exists due to Guzzle's RedirectMiddleware retaining fragments in generated Referer headers when the non-default allow_redirects.referer setting is enabled and a request containing a sensitive fragment follows a same-scheme redirect. An unauthenticated remote attacker can read the disclosed fragment from the incoming header when controlling the less-trusted redirect destination.
Affected software
guzzle
How to mitigate CVE-2026-67354
Install security update from vendor's website.
guzzle - update to 7.15.1