guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allow_redirects.referer setting is enabled, the middleware copies the URI fragment (the portion after '#') from the referring request into the generated Referer header when following a same-scheme redirect (e.g., HTTPS to HTTPS). An attacker who controls the redirect destination can read this fragment from the incoming Referer header, potentially disclosing one-time login secrets, access tokens, state values, or other sensitive client data to a server never meant to receive it. The referer setting is disabled by default. Fixed in 7.15.1, which strips the fragment before generating the Referer value.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in
    RedirectMiddleware. When the optional allow_redirects.referer setting is enabled, the middleware copies
    the URI fragment (the portion after '#') from the referring request into the generated Referer header when
    following a same-scheme redirect (e.g., HTTPS to HTTPS). An attacker who controls the redirect destination
    can read this fragment from the incoming Referer header, potentially disclosing one-time login secrets,
    access tokens, state values, or other sensitive client data to a server never meant to receive it. The
    referer setting is disabled by default. Fixed in 7.15.1, which strips the fragment before generating the
    Referer value. (CVE-2026-67354)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in     RedirectMiddleware. When the optional allow_redirects.referer setting is enabled, the middleware copies     the URI fragment (the portion after '#') from the referring request into the generated Referer header when     following a same-scheme redirect (e.g., HTTPS to HTTPS). An attacker who controls the redirect destination     can read this fragment from the incoming Referer header, potentially disclosing one-time login secrets,     access tokens, state values, or other sensitive client data to a server never meant to receive it. The     referer setting is disabled by default. Fixed in 7.15.1, which strips the fragment before generating the     Referer value. (CVE-2026-67354)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
445633	SCA: security update for guzzlehttp/guzzle (GHSA-h95v-h523-3mw8)	Tenable Cloud Security	SCA Checks	Local	high
445633	SCA: security update for guzzlehttp/guzzle (GHSA-h95v-h523-3mw8)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
331636	Linux Distros Unpatched Vulnerability : CVE-2026-67354	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-67354

high

Tenable Plugins

high

high

high