CVE-2026-93682

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel.

An Out-of-Bounds Read vulnerability (CVE-2026-93682) has been identified in the redirect handling of PHP's HTTP stream wrapper, which allows a malicious or impersonated web server to make PHP read one byte past the end of the heap buffer holding an empty Location header, with the value of that byte deciding which redirect target PHP builds. PHP tracks this issue as GHSA-7875-c8px-7q5f.

Per MITRE CWE-125: The product reads data past the end, or before the beginning, of the intended buffer.

This issue affects PHP 8.1.32 through 8.1.34, PHP 8.2.28 through 8.2.33, PHP 8.3.18 through 8.3.33, PHP 8.4.5 through 8.4.25 and PHP 8.5.0 through 8.5.10, which includes the End-of-Life PHP 8.1 release line from 8.1.32 through its final release (8.1.34). Releases without the CVE-2025-1861 fix, such as every release of PHP 5.6 through 8.0 (among them the End-of-Life releases 5.6.40, 7.2.34 and 7.4.33 as published), are not affected, because they never follow an empty Location header.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/standard, HTTP stream wrapper)
• Affected versions: >=8.1.32 <=8.1.34, >=8.2.28 <8.2.34, >=8.3.18 <8.3.35, >=8.4.5 <8.4.26, >=8.5.0 <8.5.11
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11
  • NES for PHP 5.6.1 (based on PHP 5.6.40)
  • NES for PHP 7.2.1 (based on PHP 7.2.34)
  • NES for PHP 7.3.1 (based on PHP 7.3.33)
  • NES for PHP 7.4.1 (based on PHP 7.4.33)
  • NES for PHP 8.0.1 (based on PHP 8.0.30)
  • NES for PHP 8.1.1 (based on PHP 8.1.34)

Vulnerability Info

This Medium-severity vulnerability is found in the HTTP stream wrapper of PHP 8.1 from 8.1.32 through its final release (8.1.34), 8.2 before 8.2.34, 8.3 before 8.3.35, 8.4 before 8.4.26 and 8.5 before 8.5.11; the End-of-Life PHP 8.1 release line never received the upstream fix. The PHP project scores it 5.8 under CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N). The advisory states that the flaw was introduced by the fix for CVE-2025-1861 and exists only from 8.2.28, 8.3.18 and 8.4.5 onward (and in 8.1.32 and later 8.1 releases, which received no fix).

When file_get_contents(), fopen() or another function opens an http:// or https:// URL, PHP follows redirects by default. Since the CVE-2025-1861 fix, the wrapper copies the Location value into a heap buffer sized to its length plus a terminating NUL, so for an empty Location the buffer is a single byte holding the NUL. The redirect code then treats a value that does not start with / as a relative path and checks its second character to decide whether to resolve it against the current request's directory. In PHP 8.2.33:

char *loc_path = NULL;
if (*header_info.location != '/') {
    if (*(header_info.location+1) != '\0' && resource->path) {
        char *s = strrchr(ZSTR_VAL(resource->path), '/');

With an empty value, header_info.location+1 lies one byte past the allocation. If that byte happens to be NUL, PHP redirects to the host root; otherwise it builds a path under the current directory. The advisory notes that the byte itself is never returned, so at most one bit (whether it is zero) can be observed through the next request, and that the Zend memory manager places the allocation in an 8-byte bin, so the process does not crash. The practical effect is an unpredictable redirect target and undefined behavior that memory checkers report.

Exploitation needs code that fetches a URL through the HTTP stream wrapper with allow_url_fopen on and follow_location on (the default), from a server the attacker controls or can impersonate, under any SAPI. HeroDevs' analysis found that PHP 5.6.40 and 7.4.33 as released only follow a non-empty Location, and the PHP 7.2.34 code likewise redirects only when location[0] != '\0', so the published End-of-Life releases are not exposed. The NES releases for these lines carry the CVE-2025-1861 fix, which brings in the affected code, and ship this fix with it.

The fix tests the stored length instead of reading the second byte. A follow-up change keeps one-character relative locations resolving against the host root, as before:

char *loc_path = NULL;
if (*header_info.location != '/') {
    if (header_info.location_len > 1 && resource->path) {
        char *s = strrchr(ZSTR_VAL(resource->path), '/');

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 8.1 is End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, set the follow_location stream context option to 0 when fetching URLs from servers that are not trusted, or disable allow_url_fopen where remote URLs are not needed.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 8.2.34, 8.3.35, 8.4.26, 8.5.11, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• Ilia Alshanetsky (finder, remediation)
• Jordi Kroon (remediation)