CVE-2026-67354: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-67354 is an information disclosure vulnerability in the RedirectMiddleware component of guzzlehttp/guzzle, a widely used PHP HTTP client library. When the optional allow_redirects.referer setting is enabled, the middleware incorrectly copies the URI fragment (the portion after #) from the referring request URI into the generated Referer header when following same-scheme redirects (e.g., HTTPS to HTTPS). This can expose sensitive data such as one-time login secrets, access tokens, or state values to an attacker-controlled redirect destination. All versions before 7.15.1 are affected; the issue was published on August 1, 2026, and patched in version 7.15.1. It carries a CVSS v3.1 score of 5.9 (Medium) and a CVSS v4.0 score of 8.2 (High) (GitHub Advisory, GitHub Advisory DB).

The root cause is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data) and CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer). Per RFC standards, URI fragments are handled client-side and are never transmitted in the HTTP request target to the origin server; however, Guzzle's RedirectMiddleware was incorrectly retaining the fragment when constructing the Referer header for same-scheme redirects. While Guzzle already stripped user credentials from the Referer value, it failed to strip the fragment component, meaning a redirect to a less-trusted destination (e.g., a third-party server) would receive a Referer header containing the full fragment, including any sensitive data embedded there. Exploitation requires three conditions to be met simultaneously: the application must have allow_redirects.referer enabled (non-default), the request URI must contain a sensitive fragment, and the redirect must follow to a less-trusted same-scheme destination (GitHub Advisory).

Successful exploitation allows an attacker who controls a redirect destination to read URI fragments from incoming Referer headers, potentially disclosing one-time login secrets, OAuth access tokens, CSRF state values, or other sensitive client data. There is no integrity or availability impact — the vulnerability is purely a confidentiality concern. The scope is limited to applications that explicitly enable the allow_redirects.referer option and use URI fragments to carry sensitive data, but in such configurations the exposure can lead to account takeover or session hijacking (GitHub Advisory, GitHub Advisory DB).

1. Identify a target application: Find a PHP application using guzzlehttp/guzzle versions before 7.15.1 that has allow_redirects.referer explicitly enabled in its HTTP client configuration.
2. Craft a redirect chain: Set up or identify a server that issues a same-scheme redirect (e.g., HTTPS → HTTPS) from a trusted endpoint to an attacker-controlled destination.
3. Embed sensitive data in the fragment: Trigger or wait for the target application to make a request to a URI containing a sensitive fragment (e.g., https://trusted.example.com/login#token=abc123), which may occur naturally in OAuth flows or magic-link authentication.
4. Receive the Referer header: When the vulnerable RedirectMiddleware follows the redirect, it generates a Referer header containing the full URI including the fragment (e.g., Referer: https://trusted.example.com/login#token=abc123) and sends it to the attacker-controlled redirect destination.
5. Extract sensitive data: Read the Referer header from incoming requests on the attacker-controlled server (via access logs or application code) to obtain the fragment value, then use the extracted token or secret to impersonate the victim (GitHub Advisory).

• Network: Outbound HTTPS requests from application servers to unexpected third-party destinations containing a Referer header with a URI fragment (i.e., Referer: header values containing #).
• Logs: Application or web server access logs showing Referer headers with fragment components (e.g., Referer: https://example.com/path#sensitive_token) in requests directed to external or less-trusted hosts.
• Application Behavior: Unexpected authentication failures or token reuse events following redirect-heavy workflows, which may indicate a fragment token was captured and replayed by an attacker.

Upgrade guzzlehttp/guzzle to version 7.15.1 or later, which strips the URI fragment before generating the Referer header value. As an immediate workaround for those unable to upgrade, ensure allow_redirects.referer is set to false (which is the default) in all HTTP client configurations. Additionally, avoid placing sensitive data such as tokens or secrets in URI fragments in requests that may follow redirects, and consider disabling automatic redirects and manually following only trusted destinations (GitHub Advisory).

The advisory was authored and published by GrahamCampbell, a prominent Guzzle maintainer, on July 18, 2026, with the CVE formally published on August 1, 2026. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability database aggregation (GitHub Advisory).