The vulnerability in guzzlehttp/guzzle prior to 7.15.1 involves the RedirectMiddleware copying the URI fragment (portion after '#') from the referring request into the Referer header when following same-scheme redirects if the allow_redirects.referer option is enabled. An attacker controlling the redirect destination can read this fragment from the Referer header, potentially disclosing sensitive client data like one-time login secrets, access tokens, or state values. By default, the referer setting is disabled, reducing exposure. The vulnerability is addressed in version 7.15.1 by removing the URI fragment before setting the Referer header.

An attacker who controls the redirect destination can obtain sensitive client information included in the URI fragment of the referring request, such as one-time login secrets or access tokens, due to the fragment being copied into the Referer header. This leads to information disclosure without affecting integrity or availability. The vulnerability requires the allow_redirects.referer setting to be enabled, which is disabled by default.

Upgrade guzzlehttp/guzzle to version 7.15.1 or later, where the vulnerability is fixed by stripping the URI fragment before generating the Referer header. If upgrading is not immediately possible, ensure the allow_redirects.referer setting remains disabled to avoid exposure. Patch status is confirmed fixed in 7.15.1.