GHSA-H95V-H523-3MW8: GHSA-H95V-H523-3MW8: Sensitive URI Fragment Disclosure via Referer Headers in Guzzle HTTP Client

#security #cve #cybersecurity #ghsa

GHSA-H95V-H523-3MW8: Sensitive URI Fragment Disclosure via Referer Headers in Guzzle HTTP Client

Vulnerability ID: GHSA-H95V-H523-3MW8
CVSS Score: 5.9
Published: 2026-07-20

An issue in Guzzle's RedirectMiddleware allows client-side URI fragments to be leaked over the network in Referer headers during same-scheme HTTP redirects.

TL;DR

Guzzle HTTP client leaks client-side URI fragments containing sensitive data (like access tokens) in Referer headers when auto-redirects are configured with referer tracking enabled.

Technical Details

CWE ID: CWE-201
Attack Vector: Network (AV:N)
CVSS Score: 5.9 (Medium)
Exploit Status: None/Unproven
EPSS Score: N/A
CISA KEV Status: Not Listed
Impact: Information Disclosure

Affected Systems

guzzlehttp/guzzle
guzzlehttp/guzzle: < 7.15.1 (Fixed in: 7.15.1)

Code Analysis

Commit: 7b68220

Fix Referer and Cookie scope issues in RedirectMiddleware

Mitigation Strategies

Upgrade Guzzle to version 7.15.1 or newer
Ensure the referer redirect option is disabled
Manually strip fragments from URIs prior to executing requests

Remediation Steps:

Verify the current Guzzle version using 'composer show guzzlehttp/guzzle'.
Update the dependency to version 7.15.1 or newer by running 'composer update guzzlehttp/guzzle'.
Audit configuration files to confirm 'allow_redirects.referer' is not explicitly enabled or set to true.
Implement manual URI sanitization using PSR-7 'withFragment' if legacy version upgrades are blocked.

References

Read the full report for GHSA-H95V-H523-3MW8 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community