Information Disclosure Vulnerability in GuzzleHTTP Library

CVE-2026-67354

What is CVE-2026-67354?

The GuzzleHTTP library, specifically versions prior to 7.15.1, contains an information disclosure flaw in its RedirectMiddleware. When the optional 'allow_redirects.referer' setting is enabled, sensitive URI fragments from the previous requests can be inadvertently included in the 'Referer' header during same-scheme redirects. This allows an attacker, controlling the redirect, to extract sensitive data such as one-time login tokens, access keys, or other confidential client information that may not be intended for the receiving server. The vulnerability has been addressed in version 7.15.1 by ensuring that the URI fragment is stripped before the 'Referer' header is generated.

References