CVE-2026-93682 in PHP
Summary
by MITRE • 09/25/2026
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability described constitutes an off-by-one error within the HTTP stream wrapper implementation, specifically triggered during the processing of HTTP redirection responses. This flaw arises when the underlying protocol handler encounters a redirect status code accompanied by a Location header that contains an empty string value. In standard web server behavior, such headers typically indicate where the client should navigate next, but in this specific edge case involving an empty location field, the internal logic fails to properly validate buffer boundaries before attempting to parse or copy data from the response stream.
Technically, the issue stems from a heap-based out-of-bounds read operation. When the redirect code attempts to construct the new target URL based on the Location header, it reads one byte beyond the allocated end of the heap buffer that holds the location string. This memory access is not random; rather, the value retrieved from this adjacent memory location directly influences the control flow and data construction logic. Specifically, the content of this out-of-bounds byte determines whether the client application redirects to the root directory of the host or remains in the current working directory. This behavior indicates that the buffer management routine lacks sufficient bounds checking for empty strings or short headers where subsequent bytes might be interpreted as significant control flags rather than mere padding data.
The operational impact of this vulnerability is primarily related to unintended navigation and potential information leakage, although it does not typically result in direct code execution due to its read-only nature. By manipulating the memory state adjacent to the Location header buffer, a malicious server can influence the client's browsing context. If an attacker controls the response headers and can predict or manipulate the heap layout such that specific bytes are placed after the empty location string, they could potentially force the application into unexpected states. While the immediate effect is limited to redirecting users between host roots and current directories, this behavior violates the principle of least surprise in web client operations and may be leveraged as part of a larger attack chain involving social engineering or session hijacking if combined with other vulnerabilities that exploit navigation state changes.
From a classification perspective, this flaw aligns closely with CWE-125, which describes Out-of-bounds Read, where software reads past the end of an allocated buffer. Additionally, it relates to CWE-697 regarding Incorrect Comparison During Redirect Handling, as the logic for determining the redirect target relies on incorrect memory access rather than proper header parsing rules. In terms of adversary tactics, this behavior could be associated with ATT&CK technique T1048, specifically Exfiltration Over Alternative Protocol if the redirection is used to funnel traffic through attacker-controlled domains, although in its current form it represents a logic error more than an active exfiltration vector.
Mitigation strategies must focus on rigorous input validation and buffer boundary checks within the HTTP stream wrapper implementation. Developers should ensure that all header values are validated for length before any memory operations are performed, particularly when handling empty strings or headers with minimal content. Implementing strict bounds checking during string copying and URL construction processes will prevent reads from adjacent heap regions. Furthermore, fuzz testing of HTTP parsers against malformed responses containing empty headers is essential to identify similar edge cases across the codebase. Security patches should prioritize correcting the logic that interprets out-of-bounds data as valid redirect targets, ensuring that empty Location headers are handled according to RFC standards rather than relying on undefined memory states.