{"vulnerability": "GHSA-h95v-h523-3mw8", "sightings": [{"uuid": "48d903e0-c857-40d9-8aba-b48b89de29da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-h95v-h523-3mw8", "type": "seen", "source": "https://gist.github.com/alon710/07f073f92ce20c0890f37523b73f7af8", "content": "# GHSA-H95V-H523-3MW8: GHSA-H95V-H523-3MW8: Sensitive URI Fragment Disclosure via Referer Headers in Guzzle HTTP Client\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/GHSA-H95V-H523-3MW8\n\n## Summary\nAn issue in Guzzle's RedirectMiddleware allows client-side URI fragments to be leaked over the network in Referer headers during same-scheme HTTP redirects.\n\n## TL;DR\nGuzzle HTTP client leaks client-side URI fragments containing sensitive data (like access tokens) in Referer headers when auto-redirects are configured with referer tracking enabled.\n\n## Technical Details\n\n- **CWE ID**: CWE-201\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.9 (Medium)\n- **Exploit Status**: None/Unproven\n- **EPSS Score**: N/A\n- **CISA KEV Status**: Not Listed\n- **Impact**: Information Disclosure\n\n## Affected Systems\n\n- guzzlehttp/guzzle\n- **guzzlehttp/guzzle**: < 7.15.1 (Fixed in: `7.15.1`)\n\n## Mitigation\n\n- Upgrade Guzzle to version 7.15.1 or newer\n- Ensure the referer redirect option is disabled\n- Manually strip fragments from URIs prior to executing requests\n\n**Remediation Steps:**\n1. Verify the current Guzzle version using 'composer show guzzlehttp/guzzle'.\n2. Update the dependency to version 7.15.1 or newer by running 'composer update guzzlehttp/guzzle'.\n3. Audit configuration files to confirm 'allow_redirects.referer' is not explicitly enabled or set to true.\n4. Implement manual URI sanitization using PSR-7 'withFragment' if legacy version upgrades are blocked.\n\n## References\n\n- [GitHub Advisory GHSA-H95V-H523-3MW8](https://github.com/guzzle/guzzle/security/advisories/GHSA-h95v-h523-3mw8)\n- [Fix Commit](https://github.com/guzzle/guzzle/commit/7b68220d6543f6f80fe62e633361fc9d4ead14d4)\n- [RFC 9110 Section 10.1.3](https://www.rfc-editor.org/rfc/rfc9110.html#section-10.1.3)\n- [RFC 3986 Section 3.5](https://www.rfc-editor.org/rfc/rfc3986.html#section-3.5)\n- [RFC 9700 Section 4.2.3](https://www.rfc-editor.org/rfc/rfc9700.html#section-4.2.3)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-H95V-H523-3MW8) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T00:31:29.009591Z"}]}