Out-of-bounds read in PHP - CVE-2026-93682

Vulnerability details

The vulnerability allows a remote attacker to disclose limited information.

The vulnerability exists due to an out-of-bounds read in the HTTP stream wrapper redirect handling when processing a redirect response with an empty Location header. A remote attacker can operate a server that a PHP application fetches from, or redirect a request to such a server, to disclose limited information.

At most one bit, indicating whether the out-of-bounds byte is zero, is observable through the request path received by the server.

Affected software

How to mitigate CVE-2026-93682

External References

• https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f
• https://github.com/php/php-src/pull/23467

Related Security Bulletins

• Multiple vulnerabilities in PHP