CVE-2026-93682: Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
Fixed (Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header). (CVE-2026-93682)
Other sources
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.4.26 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.3.35-1
Event History
Frequently Asked Questions
When is this issue reachable in an application?
It is reachable when PHP's HTTP stream wrapper follows a redirect whose Location header is empty. The issue is an out-of-bounds read in that redirect-handling path.
What fix information is available?
The issue is marked fixed. The provided reference is the PHP 8.3.35 changelog.