CVE-2026-93682

Summary

When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory.

Affected Software

VendorProductVersion RangeStatus
PHP GroupPHP8.2.* < 8.2.34affected
PHP GroupPHP8.3.* < 8.3.35affected
PHP GroupPHP8.4.* < 8.4.26affected
PHP GroupPHP8.5.* < 8.5.11affected

Weaknesses

  • CWE-125: CWE-125 Out-of-bounds read

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: yes
    • Technical Impact: partial

Additional References

References