CVE-2026-93682 Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
A malicious server can trigger an out-of-bounds read in PHP's HTTP stream wrapper, potentially leaking heap memory contents to influence redirect behavior.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93682?
CVE-2026-93682 is a medium-severity vulnerability in Php Php, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory.
Weakness: CWE-125
Which versions are affected by CVE-2026-93682?
3 open source packages ship an affected version, including libphp, php and php-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | From 8.2.0 | 8.2.34, 8.3.35, 8.4.26, 8.5.11 |
php Bitnami | From 8.2.0 | 8.2.34, 8.3.35, 8.4.26, 8.5.11 |
php-min Bitnami | From 8.2.0 | 8.2.34, 8.3.35, 8.4.26, 8.5.11 |
Products include Php Php.
How do I fix CVE-2026-93682?
Upgrade libphp to a fixed version for your release line: 8.2.34, 8.3.35, 8.4.26 or 8.5.11.
Is CVE-2026-93682 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-93682 exists.
Other vulnerabilities in Php Php
Sources
Also known as AZL-104913, BELL-CVE-2026-93682, BIT-libphp-2026-93682, BIT-php-2026-93682, BIT-php-min-2026-93682, CLEANSTART-2026-NP31070 and 11 more.