CVE-2026-93682

A flaw was found in PHP. When the HTTP stream wrapper processes a redirect response containing an empty Location header, an out-of-bounds read occurs by accessing memory beyond the allocated buffer. A malicious server can exploit this flaw to influence the client's redirect target path, potentially routing subsequent requests to unintended locations based on adjacent heap memory.

This vulnerability is rated as a Moderate severity flaw because exploitation is limited to influencing internal redirect path resolution and does not allow remote code execution or arbitrary memory disclosure. In typical Red Hat Enterprise Linux environments, exposure requires a PHP application to fetch remote resources from untrusted external web endpoints using built-in stream functions. Because the out-of-bounds read is confined to a single adjacent heap byte when encountering an empty redirection header, an attacker can only manipulate whether subsequent requests target the server root or current path rather than gaining system privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.