CVE-2026-67354: Guzzle Referer Uri Fragment Leakcve-2026-67354-guzzle-referer-uri-fragment-leak
When stripping user info from a PSR-7 URI (e.g. for Referer headers), the URI fragment is not stripped using withFragment(''). This can leak sensitive data contained in URI fragments (such as access tokens or state values) to redirect targets.
