PHP HTTP Stream Wrapper OOB Read Vulnerability (CVE-2025-59682) Analysis

PHP HTTP Stream Wrapper Out-of-Bounds Read Vulnerability (GHSA-7875-c8px-7qsf) Vulnerability Overview Type: Out-of-bounds read Severity: Medium (CVSS 3.1: 5.3/10) Description: When the HTTP stream wrapper follows a redirect and the response carries an empty header, the code reads one byte past the end of a heap buffer. The value of this out-of-bounds read byte determines the redirect target; an attacker can control whether the client is redirected to the host root directory or the current directory by leveraging a malicious server. Scope of Impact Affected Package: ext-standard (PHP) Affected Versions: - < 8.2.34 - < 8.3.35 - < 8.4.26 - < 8.5.11 Fixed Versions: - 8.2.34 - 8.3.35 - 8.4.26 - 8.5.11 Technical Details Root Cause: stores the value in a heap buffer sized exactly . For an empty value, this constitutes a single-byte block containing only the NUL terminator. The redirect processing code treats any relative path not starting with as such, and dereferences the second byte to determine whether to append the current request path's directory. CVE ID: CVE-2025-59682 CWE: CWE-125 (Out-of-bounds Read) Fix Solution The fix changes to and uses to prevent the out-of-bounds read. POC Code Impact An attacker who controls the server accessed by the PHP application or can redirect such requests can trigger a one-byte heap out-of-bounds read. This byte is not returned to the attacker; it is used solely to select one of two redirect targets (at most one byte). The zero value is observable because the request path switches between the two redirect targets. Since single-byte allocations reside within 8-byte blocks in the memory manager, the read does not cause a process crash. The actual effect is non-deterministic redirect targets and undefined behavior, as reported by ASan and Valgrind.

Goal Reached Thanks to every supporter — we hit 100%!

PHP HTTP Stream Wrapper OOB Read Vulnerability (CVE-2025-59682) Analysis

More from this source