PT-2026-67327 · Composer · Guzzle
CVSS v4.0
8.2
High
| Vector | AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
guzzlehttp/guzzle versions prior to 7.15.1
Description
An information disclosure issue exists in the
RedirectMiddleware when the optional allow redirects.referer setting is enabled. During a same-scheme redirect (such as HTTPS to HTTPS), the middleware copies the URI fragment—the portion of the URI following the # symbol—into the generated Referer header. While URI fragments are typically handled locally by the client and not sent to the server in the initial request, this behavior allows a destination server controlling the redirect to read the fragment from the incoming header. This could lead to the disclosure of sensitive client data, such as access tokens, state values, or one-time login secrets. This issue affects both cURL and stream handlers. The referer setting is disabled by default.Recommendations
Update guzzlehttp/guzzle to version 7.15.1 or later.
As a temporary workaround, ensure the
allow redirects.referer setting is set to false.
Alternatively, disable automatic redirects and follow trusted destinations manually, or remove the fragment from the request URI before sending a request that may redirect.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Guzzle