CVE-2026-93682
mediumpriority · track · 0EPSS 0.003 · 27 %ileDEUSEPSS · scored 2026-10-28
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (28)
Products and version ranges known to be affected.
advisories (4)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-3585PHP: Mehrere SchwachstellenDeutsch2026-09-24csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen oder die Integrität zu verletzen.
- BIT-libphp-2026-93682Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header2026-10-01vendor · osvUS
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory.
- BIT-php-2026-93682Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header2026-10-01vendor · osvUS
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory.
- BIT-php-min-2026-93682Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header2026-10-01vendor · osvUS
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (1) nvd
External citations — patches, advisories, analysis.
- https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5fVendor AdvisoryExploit
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan