Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.8
CVE-2026-93682: PHP could send users to unintended page after redirect
CVE-2026-93682 · published 1 month ago
Summary
Certain versions of PHP (5, 7.0, 7.2, 8.2, and 8.4) can misinterpret an empty redirect address sent by a web server. This can cause the browser to be sent to the website’s main page instead of the intended location, which a malicious site could exploit. Apply the latest security updates for PHP or upgrade to a newer supported version.
What to do
- Update debian php8.4 to version 8.4.26-1~deb13u1.
- Update bellsoft php83 to version 8.3.35-r0.
- Update libphp to version 8.5.11.
- Update php to version 8.5.11.
- Update php-min to version 8.5.11.
- Update debian php8.2 to version 8.2.34-1~deb12u1.
- Update php group php to version 8.2.34 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | php8.2 |
< 8.2.34-1~deb12u1 Fix: upgrade to 8.2.34-1~deb12u1
|
| Debian:13 | debian | php8.4 |
< 8.4.26-1~deb13u1 Fix: upgrade to 8.4.26-1~deb13u1
|
| Debian:14 | debian | php8.4 | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | php5 | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | php7.0 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | php7.2 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | php7.4 | All versions |
| Ubuntu:22.04:LTS | canonical | php8.1 | All versions |
| Ubuntu:24.04:LTS | canonical | php8.3 | All versions |
| Ubuntu:26.04:LTS | canonical | php8.5 | All versions |
| – | php group | php | < 8.2.34 |
| Alpaquita:25 | bellsoft | php83 |
>= 8.3.21-r0, < 8.3.35-r0 Fix: upgrade to 8.3.35-r0
|
| Alpaquita:stream | bellsoft | php83 |
>= 8.3.4-r2, < 8.3.35-r0 Fix: upgrade to 8.3.35-r0
|
| Bitnami | – | libphp |
>= 8.5.0, < 8.5.11 Fix: upgrade to 8.5.11
|
| Bitnami | – | php |
>= 8.5.0, < 8.5.11 Fix: upgrade to 8.5.11
|
| Bitnami | – | php-min |
>= 8.5.0, < 8.5.11 Fix: upgrade to 8.5.11
|
| – | php | php |
>= 8.2.0, < 8.2.34 >= 8.3.0, < 8.3.35 >= 8.4.0, < 8.4.26 >= 8.5.0, < 8.5.11 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* |
Original advisory text
Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory.
References
- https://github.com/php/php-src/pull/23467 Third Party Advisory
- https://github.com/php/php-src/pull/23521 Third Party Advisory
- https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f URL
- https://ubuntu.com/security/CVE-2026-93682 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-93682 Third Party Advisory
- https://github.com/php/php-src/blob/php-8.4.26/NEWS Third Party Advisory
- https://docs.bell-sw.com/security/cves/CVE-2026-93682 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-93682 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-93682 URL
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
5.8
Medium
Type
CWE-125Out-of-bounds Read
Timeline
Published1 Oct 2026
Updated4 Nov 2026
First seen24 Sep 2026
Sources
DEBIAN-CVE-2026-93682 · OSV
UBUNTU-CVE-2026-93682 · OSV
CVE-2026-93682 · NVD
CVE-2026-93682 · MITRE
BELL-CVE-2026-93682 · OSV
BIT-php-min-2026-93682 · OSV
BIT-php-2026-93682 · OSV
Track software like this
Free during beta