Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-93682— Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header

Quick assessment

Affected
PHP Group PHP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

当 HTTP 流包装器（stream wrapper）跟随重定向时，若响应中携带的 Location 头部为空值，重定向代码会在持有该位置信息的堆缓冲区末尾多读取一个字节。该越界字节的值决定了最终构建的重定向目标，因此攻击者可通过恶意服务器控制客户端是被重定向到主机根目录还是当前目录。

CVSS 5.8 · Medium EPSS 0.35% · P27

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-93682

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
Source: CVE Program / CVE List V5
Vulnerability Description
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
PHP Group PHP 8.2.* ~ 8.2.34 -

II. Public POCs for CVE-2026-93682

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-93682

请登录查看更多情报信息。

Other References for CVE-2026-93682 (1)

Same Patch Batch · PHP Group · 2026-09-25 · 11 CVEs total

CVE-2026-91765 7.5 HIGH SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
CVE-2026-17545 6.9 MEDIUM PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can ca
CVE-2026-91767 6.5 MEDIUM Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard
CVE-2026-91768 6.5 MEDIUM IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcm
CVE-2025-14181 6.5 MEDIUM Integer overflow to buffer overflow in soap HTTP parsing
CVE-2026-92842 5.9 MEDIUM OOB read / info leak in convert.* stream filters when line-break-chars contains NUL
CVE-2026-91766 5.9 MEDIUM Cross-origin credential leak in HTTP stream wrapper redirects
CVE-2026-6103 4.3 MEDIUM Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection
CVE-2026-91769 4.3 MEDIUM TLS Hostname Verification Falls Back to CN After SAN Mismatch
CVE-2025-1218 3.4 LOW Various packet overreads in mysqlnd_writeprotocol.c

IV. Related Vulnerabilities

Same product: PHP
Same vendor: PHP Group
Same weakness: CWE-125

V. Comments for CVE-2026-93682

No comments yet

Leave a comment