Heap Buffer Vulnerability in PHP HTTP Stream Wrapper

CVE-2026-93682

What is CVE-2026-93682?

The PHP HTTP stream wrapper is affected by a vulnerability where a redirect response containing an empty Location header causes the redirect code to read beyond the end of the heap buffer. This out-of-bounds access can lead to the construction of an incorrect redirect target. Consequently, a malicious server could exploit this flaw to control the client's redirect behavior, potentially leading the user to unintended locations, such as the root of the host or to the current directory. It's crucial for users to review their PHP installations and follow security advisories to mitigate the risks associated with this vulnerability.

References