CVE-2026-93682: PHP HTTP stream wrapper out-of-bounds read in redirect handling

CVE-2026-93682 · Severity: medium · CVSS 5.8 · Published 2026-09-25

PHP's HTTP stream wrapper, which allows web applications to fetch content from remote servers, contains a memory reading vulnerability when following redirects with empty Location headers. A malicious server can exploit this to redirect users unpredictably, though the practical impact is limited to non-deterministic redirect behavior rather than direct data exposure.

Technologies: Php. Vendors: PHP.

Quick answers

Is CVE-2026-93682 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-93682 being exploited in the wild.
How severe is CVE-2026-93682?
Medium severity, with a CVSS score of 5.8, published 25 September 2026.
Which products and versions are affected?
Php 8.1.32+, 8.2.0 through 8.2.33, 8.3.0 through 8.3.34, 8.4.0 through 8.4.25, 8.5.0 through 8.5.10.
Is there a fix for CVE-2026-93682?
A patch was published on 2026-09-25: PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93682 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-93682?
Check whether you run Php at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a one-byte out-of-bounds heap read in the HTTP stream wrapper's redirect handling code (http_fopen_wrapper.c). When an empty Location header is processed, the allocation is sized for the NUL terminator only, but the redirect logic reads a second byte to determine whether the location is absolute or relative. An attacker controlling a server can influence this stray byte to alter the redirect target, though the byte is never exposed—only its value affects path resolution.

Affected products

  • PHP PHP 8.1.32+, 8.2.0 through 8.2.33, 8.3.0 through 8.3.34, 8.4.0 through 8.4.25, 8.5.0 through 8.5.10

Timeline

  • 2026-09-25: disclosed: CVE-2026-93682 published
  • 2026-09-25: patched: PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.