CVE-2026-67354
Description
A flaw was found in guzzlehttp/guzzle. This vulnerability, located in the RedirectMiddleware, can lead to information disclosure. When the optional allow_redirects.referer setting is enabled, the middleware copies the URI fragment (the portion after '#') from a referring request into the generated Referer header during same-scheme redirects. An attacker controlling the redirect destination can read this fragment, potentially exposing sensitive client data such as one-time login secrets or access tokens. The referer setting is disabled by default.
Statement
Community packages in Fedora and EPEL that bundle guzzlehttp/guzzle (nextcloud, roundcubemail) already ship patched versions (7.15.2 and 7.15.3 respectively) that include the fix for this vulnerability, and are therefore not affected. Additionally, exploitation requires the non-default allow_redirects.referer setting to be enabled.
Mitigation
Upgrade guzzlehttp/guzzle to version 7.15.1 or later.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Files or Directories; Read Memory; Read Application Data
Sensitive data may be exposed to attackers.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
