{"action":"Upgrade guzzlehttp/guzzle to 7.15.1 or later.","affected":[{"fixed":"7.15.1","introduced":"0"}],"component":"guzzlehttp/guzzle","cve_ids":["CVE-2026-67354"],"ecosystem":"Packagist","epss":0.00372,"exploited":false,"fixed_versions":["7.15.1"],"ghsa_id":"GHSA-h95v-h523-3mw8","id":"tcs_01M5KF3HETZQ61MFS1KAYAZJZ7","modified_at":"2026-09-10T03:50:52.523072195Z","published_at":"2026-07-20T23:28:36Z","references":["https://osv.dev/vulnerability/GHSA-h95v-h523-3mw8","https://github.com/guzzle/guzzle/security/advisories/GHSA-h95v-h523-3mw8","https://nvd.nist.gov/vuln/detail/CVE-2026-67354","https://github.com/guzzle/guzzle/pull/3901","https://github.com/guzzle/guzzle/commit/7b68220d6543f6f80fe62e633361fc9d4ead14d4","https://github.com/guzzle/guzzle","https://github.com/guzzle/guzzle/releases/tag/7.15.1","https://www.vulncheck.com/advisories/guzzlehttp-guzzle-before-uri-fragment-disclosure-via-referer"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-h95v-h523-3mw8","url":"https://osv.dev/vulnerability/GHSA-h95v-h523-3mw8"}],"summary":"Guzzle: URI fragments disclosed in redirect Referer headers"}