EUVD-2026-51825
GHSA-mqq9-gxg5-m58g
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Non-default referer configuration and attacker-controlled same-scheme redirect required (AC:H, PR:N); only confidentiality impact as no data is altered or service disrupted.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allow_redirects.referer setting is enabled, the middleware copies the URI fragment (the portion after '#') from the referring request into the generated Referer header when following a same-scheme redirect (e.g., HTTPS to HTTPS). An attacker who controls the redirect destination can read this fragment from the incoming Referer header, potentially disclosing one-time login secrets, access tokens, state values, or other sensitive client data to a server never meant to receive it. The referer setting is disabled by default. Fixed in 7.15.1, which strips the fragment before generating the Referer value.
AnalysisAI
URI fragment leakage in guzzlehttp/guzzle's RedirectMiddleware (versions before 7.15.1) exposes sensitive client-side data to unintended redirect destinations when the non-default allow_redirects.referer option is explicitly enabled. An attacker who controls a same-scheme redirect target can harvest one-time login tokens, OAuth state values, or access tokens embedded in URI fragments from the Referer header included in the redirected request. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.2 with AC:H and AT:P accurately reflects the real-world complexity - exploitation requires three simultaneous non-trivial conditions to align.
Technical ContextAI
Guzzle is the dominant PHP HTTP client library, distributed via Composer as guzzlehttp/guzzle (CPE: cpe:2.3:a:guzzle:guzzle:*:*:*:*:*:*:*:*). The affected component is RedirectMiddleware, which handles automatic HTTP redirect following. Per RFC 7231, URI fragments (the '#'-delimited suffix) are client-side constructs never transmitted to servers in HTTP request targets - they exist solely for local navigation. CWE-201 (Insertion of Sensitive Information Into Sent Data) captures the root cause: Guzzle's Referer generation logic failed to strip the fragment before copying the URI into the Referer header for same-scheme (e.g., HTTPS to HTTPS) redirects, while already correctly stripping user credentials. The vulnerability affects both the cURL and stream handler backends. The fix in 7.15.1 extends the existing sanitization to strip the fragment before Referer header generation, matching standard browser behavior.
RemediationAI
Upgrade guzzlehttp/guzzle to version 7.15.1 or later via Composer (composer require guzzlehttp/guzzle:^7.15.1); the fix is confirmed in commit 7b68220d6543f6f80fe62e633361fc9d4ead14d4 and pull request https://github.com/guzzle/guzzle/pull/3901, which strips URI fragments before Referer header generation. If immediate upgrade is not possible, ensure the allow_redirects.referer option is not set to true - its default value of false makes the application unexploitable via this vector. Audit all Guzzle request call sites for explicit 'referer' => true settings and revert them to false or remove them until the patch is applied; note that this disables automatic Referer header generation on redirects, which may affect server-side analytics or logging that depends on that header as a side effect.
Host confusion in GuzzleHttp Guzzle before 7.15.2 and 8.0.1 allows remote attackers who can influence a fetched URI to b
Cookie domain scope bypass in Guzzle PHP HTTP client (prior to 7.15.2 and 8.0.1) allows improper cookie sharing via non-
Cookie scope leakage in guzzlehttp/guzzle before 7.15.1 allows an attacker controlling a child subdomain to receive host
Guzzle is a PHP HTTP client. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authenticati
Guzzle, an extensible PHP HTTP client. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low a
Guzzle, an extensible PHP HTTP client. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low a
Guzzle is an open source PHP HTTP client. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no
Guzzle is an open source PHP HTTP client. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no
Denial of service in guzzlehttp/guzzle versions before 7.15.1 allows a malicious or compromised upstream server to exhau
Proxy-Authorization header leakage in guzzlehttp/guzzle before 7.14.2 allows origin servers to receive proxy credentials
Host validation bypass in guzzlehttp/psr7 before 2.12.3 enables URI authority confusion attacks against PHP applications
Cookie domain suffix-matching bypass in Guzzle PHP HTTP client (prior to 7.12.3) allows cross-host cookie disclosure, co
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today