CVE-2026-93682: PHP PHP vulnerability

Q: When is this issue reachable in an application?

It is reachable when PHP's HTTP stream wrapper follows a redirect whose Location header is empty. The issue is an out-of-bounds read in that redirect-handling path.

Q: What fix information is available?

The issue is marked fixed. The provided reference is the PHP 8.3.35 changelog.

Published Sep 24, 2026

Updated

Fixed (Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header). (CVE-2026-93682)

Affected Software

1 affected componentFixes available

PHP PHP<8.4.26

8.4.26

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.4.26

Event History

Sep 24, 2026

CVE Published

via PHP·12:00 AM

Data Sourced

via PHP·12:00 AM

DescriptionAffected Software

Frequently Asked Questions

When is this issue reachable in an application?

It is reachable when PHP's HTTP stream wrapper follows a redirect whose Location header is empty. The issue is an out-of-bounds read in that redirect-handling path.

What fix information is available?

The issue is marked fixed. The provided reference is the PHP 8.3.35 changelog.