Detections
Analytics
SCA: security update for guzzlehttp/guzzle (GHSA-h95v-h523-3mw8)
high Tenable Self-Hosted Container Security Plugin ID 445633
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in
RedirectMiddleware. When the optional allow_redirects.referer setting is enabled, the middleware copies
the URI fragment (the portion after '#') from the referring request into the generated Referer header when
following a same-scheme redirect (e.g., HTTPS to HTTPS). An attacker who controls the redirect destination
can read this fragment from the incoming Referer header, potentially disclosing one-time login secrets,
access tokens, state values, or other sensitive client data to a server never meant to receive it. The
referer setting is disabled by default. Fixed in 7.15.1, which strips the fragment before generating the
Referer value. (CVE-2026-67354)
Solution
Update the guzzlehttp/guzzle library and its related packages to version 7.15.1 or later.See Also
Plugin Details
Severity: High
ID: 445633
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 8/4/2026
Updated: 8/4/2026
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.75
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 5.4
Temporal Score: 4
Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:N
CVSS Score Source: CVE-2026-67354
CVSS v3
Risk Factor: Medium
Base Score: 5.9
Temporal Score: 5.2
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 8.2
Threat Score: 4.6
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 7/20/2026
Vulnerability Publication Date: 7/20/2026
Reference Information
CVE: CVE-2026-67354