Summary
Guzzle: URI fragments disclosed in redirect Referer headers
Workarounds
If you cannot upgrade immediately, leave automatic Referer generation disabled. It is off by default. If redirect options are configured explicitly, ensure that referer is false:
$client->request('GET', $uri, [
'allow_redirects' => ['referer' => false],
]);
Alternatively, disable automatic redirects and follow trusted destinations manually, or remove the fragment from the request URI before sending a request that may redirect. Do not rely on the fact that fragments are absent from the initial HTTP request target, because the affected middleware can reintroduce them in the generated header.
References
Impact
When the optional referer redirect setting is enabled, affected versions of RedirectMiddleware can copy the fragment from the referring request URI into a generated Referer header. A URI fragment is the part after #. It is handled locally by the client and is not part of the HTTP request target, so the server handling the original request does not receive it. A generated Referer tells the redirect destination which URI led to the request. Guzzle correctly removes user information from that value, but retains the fragment when it follows a redirect to the same scheme, such as HTTPS to HTTPS. For example, an initial URI ending in #secret is sent without the fragment, but the redirect destination can receive a Referer ending in #secret. This behavior affects both the cURL and stream handlers.
An attacker who controls the redirect destination can read the fragment from the incoming header, including through request logs or application code. If the fragment contains a one-time login secret, access token, state value, or other private client data, it is disclosed to a server that was never meant to receive it. Exploitation requires the application to enable allow_redirects.referer, make a request to a URI with a sensitive fragment, and follow a same-scheme redirect to a less-trusted destination.
The referer setting is disabled by default. Applications that leave it disabled, do not put sensitive data in URI fragments, do not follow redirects, or only redirect within the same trust boundary are not affected. Guzzle already omits the generated header when the scheme changes. This issue is limited to the fragment's inclusion. Reducing the path and query on cross-origin redirects is a separate privacy policy question.
GHSA-H95V-H523-3MW8 has a CVSS score of 5.9 (Medium). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (7.15.1); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
The issue is patched in 7.15.1 and later. Starting in that release, Guzzle removes both user information and the fragment before generating a redirect Referer value. Other redirect behavior does not change. Guzzle retains the referring path and query, and continues to omit the header when the scheme changes. Versions before 7.15.1 are affected when the optional referer setting is enabled.
Frequently Asked Questions
- What is GHSA-H95V-H523-3MW8? GHSA-H95V-H523-3MW8 is a medium-severity security vulnerability in guzzlehttp/guzzle (composer), affecting versions < 7.15.1. It is fixed in 7.15.1.
- How severe is GHSA-H95V-H523-3MW8? GHSA-H95V-H523-3MW8 has a CVSS score of 5.9 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of guzzlehttp/guzzle are affected by GHSA-H95V-H523-3MW8? guzzlehttp/guzzle (composer) versions < 7.15.1 is affected.
- Is there a fix for GHSA-H95V-H523-3MW8? Yes. GHSA-H95V-H523-3MW8 is fixed in 7.15.1. Upgrade to this version or later.
- Is GHSA-H95V-H523-3MW8 exploitable, and should I be worried? Whether GHSA-H95V-H523-3MW8 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-H95V-H523-3MW8 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-H95V-H523-3MW8? Upgrade
guzzlehttp/guzzleto 7.15.1 or later.