CVE-2026-93682GHSA-7875-c8px-7q5f
PHP: Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
PHP Group PHPRuntimes & languagesCVSS
5.8MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 25 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.35%Chance of exploitation activity in the next 30 days, higher than 27% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 8.2.34PHPCVE List
- 8.3.35PHPCVE List
- 8.4.26PHPCVE List
- 8.5.11PHPCVE List
- 8.2.34ext-standard, phpGitHub
- 8.3.35ext-standard, phpGitHub
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory.
Text from CVE List
Affected versions 8
- PHPaffected: 8.2.* before 8.2.34CVE List
- PHPaffected: 8.3.* before 8.3.35CVE List
- PHPaffected: 8.4.* before 8.4.26CVE List
- PHPaffected: 8.5.* before 8.5.11CVE List
- ext-standard, php<8.2.34GitHub
- ext-standard, php<8.3.35GitHub
- ext-standard, php<8.4.26GitHub
- ext-standard, php<8.5.11GitHub