AZL-104913
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-104913.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-104913
- Upstream
- CVE-2026-93682
- Published
- 2026-09-25T20:17:47Z
- Modified
- 2026-09-30T05:39:58Z
- Summary
- CVE-2026-93682 affecting package php 8.3.33-1
- Details
-
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory.
- References