Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-93682

Fixed in a distro release EPSS <1%CVSS 5.8

When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory.

Published 2026-09-25 · CVE record · OSV

Products: PHP Group PHP

Distro releases

ReleasePackageFixed in
AlmaLinux 8apcu-panel5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux 8libzip1.6.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux 8libzip1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux 8libzip1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux 8libzip-devel1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux 8libzip-devel1.6.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux 8libzip-devel1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux 8libzip-tools1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux 8libzip-tools1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux 8php7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-bcmath7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-cli7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-common7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-dba7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-dbg7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-devel7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-embedded7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-enchant7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-ffi7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-fpm7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-gd7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-gmp7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-intl7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-json7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-ldap7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-mbstring7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-mysqlnd7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-odbc7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-opcache7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-pdo7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-pear1:1.10.13-1.module_el8.10.0+3935+28808425
AlmaLinux 8php-pecl-apcu5.1.18-1.module_el8.10.0+3935+28808425
AlmaLinux 8php-pecl-apcu5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux 8php-pecl-apcu-devel5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux 8php-pecl-apcu-devel5.1.18-1.module_el8.10.0+3935+28808425
AlmaLinux 8php-pecl-rrd2.0.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux 8php-pecl-rrd2.0.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux 8php-pecl-rrd2.0.1-1.module_el8.10.0+3935+28808425
AlmaLinux 8php-pecl-xdebug2.9.5-1.module_el8.6.0+3239+bedf0508
AlmaLinux 8php-pecl-xdebug2.9.5-1.module_el8.6.0+2750+78feabcb
AlmaLinux 8php-pecl-zip1.18.2-1.module_el8.10.0+3935+28808425
AlmaLinux 8php-pecl-zip1.18.2-1.module_el8.6.0+3239+bedf0508
AlmaLinux 8php-pecl-zip1.18.2-1.module_el8.6.0+2750+78feabcb
AlmaLinux 8php-pgsql7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-process7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-snmp7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-soap7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-xml7.4.33-8.module_el8.10.0+4321+cf5fd4bb
AlmaLinux 8php-xmlrpc7.4.33-8.module_el8.10.0+4321+cf5fd4bb
Debian 12php8.28.2.34-1~deb12u1
Debian 13php8.48.4.26-1~deb13u1
Debian 14php8.48.4.26-1
Red Hat hummingbird 1php0:8.5.11-2.hum1
Red Hat hummingbird 1php-bcmath0:8.5.11-2.hum1
Red Hat hummingbird 1php-cli0:8.5.11-2.hum1
Red Hat hummingbird 1php-common0:8.5.11-2.hum1
Red Hat hummingbird 1php-dba0:8.5.11-2.hum1
Red Hat hummingbird 1php-dbg0:8.5.11-2.hum1
Red Hat hummingbird 1php-devel0:8.5.11-2.hum1
Red Hat hummingbird 1php-embedded0:8.5.11-2.hum1
Red Hat hummingbird 1php-enchant0:8.5.11-2.hum1
Red Hat hummingbird 1php-ffi0:8.5.11-2.hum1
Red Hat hummingbird 1php-fpm0:8.5.11-2.hum1
Red Hat hummingbird 1php-gd0:8.5.11-2.hum1
Red Hat hummingbird 1php-gmp0:8.5.11-2.hum1
Red Hat hummingbird 1php-intl0:8.5.11-2.hum1
Red Hat hummingbird 1php-ldap0:8.5.11-2.hum1
Red Hat hummingbird 1php-mbstring0:8.5.11-2.hum1
Red Hat hummingbird 1php-mysqlnd0:8.5.11-2.hum1
Red Hat hummingbird 1php-odbc0:8.5.11-2.hum1
Red Hat hummingbird 1php-pdo0:8.5.11-2.hum1
Red Hat hummingbird 1php-pdo-dblib0:8.5.11-2.hum1
Red Hat hummingbird 1php-pdo-firebird0:8.5.11-2.hum1
Red Hat hummingbird 1php-pgsql0:8.5.11-2.hum1
Red Hat hummingbird 1php-process0:8.5.11-2.hum1
Red Hat hummingbird 1php-snmp0:8.5.11-2.hum1
Red Hat hummingbird 1php-soap0:8.5.11-2.hum1
Red Hat hummingbird 1php-sodium0:8.5.11-2.hum1
Red Hat hummingbird 1php-tidy0:8.5.11-2.hum1
Red Hat hummingbird 1php-xml0:8.5.11-2.hum1
Rocky Linux 8libzip0:1.6.1-1.module+el8.10.0+1604+6558efc7
Rocky Linux 8libzip0:1.6.1-1.module+el8.10.0+1912+72767185
Rocky Linux 8php0:7.4.33-8.module+el8.10.0+40393+c071e357
Rocky Linux 8php-pear1:1.10.13-1.module+el8.10.0+1912+72767185
Rocky Linux 8php-pear1:1.10.13-1.module+el8.10.0+1605+02e07af7
Rocky Linux 8php-pear1:1.10.13-1.module+el8.10.0+1604+6558efc7
Rocky Linux 8php-pecl-apcu0:5.1.18-1.module+el8.10.0+1912+72767185
Rocky Linux 8php-pecl-apcu0:5.1.18-1.module+el8.10.0+1604+6558efc7
Rocky Linux 8php-pecl-rrd0:2.0.1-1.module+el8.10.0+1912+72767185
Rocky Linux 8php-pecl-rrd0:2.0.1-1.module+el8.4.0+414+2e7afcdd
Rocky Linux 8php-pecl-rrd0:2.0.1-1.module+el8.10.0+1604+6558efc7
Rocky Linux 8php-pecl-xdebug0:2.9.5-1.module+el8.10.0+1604+6558efc7
Rocky Linux 8php-pecl-xdebug0:2.9.5-1.module+el8.10.0+1912+72767185
Rocky Linux 8php-pecl-zip0:1.18.2-1.module+el8.10.0+1912+72767185
Rocky Linux 8php-pecl-zip0:1.18.2-1.module+el8.10.0+1604+6558efc7
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSapache2-mod_php77.4.33-150400.4.81.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSapache2-mod_php88.0.30-150400.4.76.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSphp77.4.33-150400.4.81.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSphp7-fastcgi7.4.33-150400.4.81.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSphp7-fpm7.4.33-150400.4.81.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSphp88.0.30-150400.4.76.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSphp8-embed8.0.30-150400.4.76.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSphp8-fastcgi8.0.30-150400.4.76.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSphp8-fpm8.0.30-150400.4.76.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSphp8-test8.0.30-150400.4.76.2
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSapache2-mod_php77.4.33-150400.4.81.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSapache2-mod_php88.0.30-150400.4.76.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSphp77.4.33-150400.4.81.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSphp7-fastcgi7.4.33-150400.4.81.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSphp7-fpm7.4.33-150400.4.81.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSphp88.0.30-150400.4.76.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSphp8-embed8.0.30-150400.4.76.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSphp8-fastcgi8.0.30-150400.4.76.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSphp8-fpm8.0.30-150400.4.76.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSphp8-test8.0.30-150400.4.76.2
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSapache2-mod_php88.0.30-150400.4.76.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSphp88.0.30-150400.4.76.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSphp8-embed8.0.30-150400.4.76.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSphp8-fastcgi8.0.30-150400.4.76.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSphp8-fpm8.0.30-150400.4.76.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSphp8-test8.0.30-150400.4.76.2
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSapache2-mod_php88.0.30-150400.4.76.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSphp88.0.30-150400.4.76.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSphp8-embed8.0.30-150400.4.76.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSphp8-fastcgi8.0.30-150400.4.76.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSphp8-fpm8.0.30-150400.4.76.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSphp8-test8.0.30-150400.4.76.2
SUSE Linux Enterprise Module for Legacy 15 SP7apache2-mod_php77.4.33-150400.4.81.1
SUSE Linux Enterprise Module for Legacy 15 SP7php77.4.33-150400.4.81.1
SUSE Linux Enterprise Module for Package Hub 15 SP7apache2-mod_php77.4.33-150400.4.81.1
SUSE Linux Enterprise Module for Package Hub 15 SP7php77.4.33-150400.4.81.1
SUSE Linux Enterprise Module for Package Hub 15 SP7php7-embed7.4.33-150400.4.81.1
SUSE Linux Enterprise Module for Package Hub 15 SP7php7-fastcgi7.4.33-150400.4.81.1
SUSE Linux Enterprise Module for Package Hub 15 SP7php7-fpm7.4.33-150400.4.81.1
SUSE Linux Enterprise Module for Package Hub 15 SP7php7-test7.4.33-150400.4.81.2
SUSE Linux Enterprise Module for Web and Scripting 15 SP7apache2-mod_php88.3.35-150700.3.21.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP7php88.3.35-150700.3.21.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP7php8-embed8.3.35-150700.3.21.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP7php8-fastcgi8.3.35-150700.3.21.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP7php8-fpm8.3.35-150700.3.21.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP7php8-test8.3.35-150700.3.21.1
SUSE Linux Enterprise Server 15 SP4-LTSSapache2-mod_php77.4.33-150400.4.81.1
SUSE Linux Enterprise Server 15 SP4-LTSSapache2-mod_php88.0.30-150400.4.76.1
SUSE Linux Enterprise Server 15 SP4-LTSSphp77.4.33-150400.4.81.1
SUSE Linux Enterprise Server 15 SP4-LTSSphp7-fastcgi7.4.33-150400.4.81.1
SUSE Linux Enterprise Server 15 SP4-LTSSphp7-fpm7.4.33-150400.4.81.1
SUSE Linux Enterprise Server 15 SP4-LTSSphp88.0.30-150400.4.76.1
SUSE Linux Enterprise Server 15 SP4-LTSSphp8-embed8.0.30-150400.4.76.1
SUSE Linux Enterprise Server 15 SP4-LTSSphp8-fastcgi8.0.30-150400.4.76.1
SUSE Linux Enterprise Server 15 SP4-LTSSphp8-fpm8.0.30-150400.4.76.1
SUSE Linux Enterprise Server 15 SP4-LTSSphp8-test8.0.30-150400.4.76.2
SUSE Linux Enterprise Server 15 SP5-LTSSapache2-mod_php77.4.33-150400.4.81.1
SUSE Linux Enterprise Server 15 SP5-LTSSapache2-mod_php88.0.30-150400.4.76.1
SUSE Linux Enterprise Server 15 SP5-LTSSphp77.4.33-150400.4.81.1
SUSE Linux Enterprise Server 15 SP5-LTSSphp7-fastcgi7.4.33-150400.4.81.1
SUSE Linux Enterprise Server 15 SP5-LTSSphp7-fpm7.4.33-150400.4.81.1
SUSE Linux Enterprise Server 15 SP5-LTSSphp88.0.30-150400.4.76.1
SUSE Linux Enterprise Server 15 SP5-LTSSphp8-embed8.0.30-150400.4.76.1
SUSE Linux Enterprise Server 15 SP5-LTSSphp8-fastcgi8.0.30-150400.4.76.1
SUSE Linux Enterprise Server 15 SP5-LTSSphp8-fpm8.0.30-150400.4.76.1
SUSE Linux Enterprise Server 15 SP5-LTSSphp8-test8.0.30-150400.4.76.2
SUSE Linux Enterprise Server 15 SP6-LTSSapache2-mod_php77.4.33-150400.4.81.1
SUSE Linux Enterprise Server 15 SP6-LTSSapache2-mod_php88.2.34-150600.3.36.1
SUSE Linux Enterprise Server 15 SP6-LTSSphp77.4.33-150400.4.81.1
SUSE Linux Enterprise Server 15 SP6-LTSSphp7-fastcgi7.4.33-150400.4.81.1
SUSE Linux Enterprise Server 15 SP6-LTSSphp7-fpm7.4.33-150400.4.81.1
SUSE Linux Enterprise Server 15 SP6-LTSSphp88.2.34-150600.3.36.1
SUSE Linux Enterprise Server 15 SP6-LTSSphp8-embed8.2.34-150600.3.36.1
SUSE Linux Enterprise Server 15 SP6-LTSSphp8-fastcgi8.2.34-150600.3.36.1
SUSE Linux Enterprise Server 15 SP6-LTSSphp8-fpm8.2.34-150600.3.36.1
SUSE Linux Enterprise Server 15 SP6-LTSSphp8-test8.2.34-150600.3.36.1
SUSE Linux Enterprise Server 16.0apache2-mod_php88.4.26-160000.1.1
SUSE Linux Enterprise Server 16.0php88.4.26-160000.1.1
SUSE Linux Enterprise Server 16.0php8-embed8.4.26-160000.1.1
SUSE Linux Enterprise Server 16.0php8-fastcgi8.4.26-160000.1.1
SUSE Linux Enterprise Server 16.0php8-fpm8.4.26-160000.1.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4apache2-mod_php77.4.33-150400.4.81.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4apache2-mod_php88.0.30-150400.4.76.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4php77.4.33-150400.4.81.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4php7-fastcgi7.4.33-150400.4.81.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4php7-fpm7.4.33-150400.4.81.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4php88.0.30-150400.4.76.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4php8-embed8.0.30-150400.4.76.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4php8-fastcgi8.0.30-150400.4.76.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4php8-fpm8.0.30-150400.4.76.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4php8-test8.0.30-150400.4.76.2
SUSE Linux Enterprise Server for SAP Applications 15 SP5apache2-mod_php77.4.33-150400.4.81.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5apache2-mod_php88.0.30-150400.4.76.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5php77.4.33-150400.4.81.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5php7-fastcgi7.4.33-150400.4.81.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5php7-fpm7.4.33-150400.4.81.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5php88.0.30-150400.4.76.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5php8-embed8.0.30-150400.4.76.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5php8-fastcgi8.0.30-150400.4.76.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5php8-fpm8.0.30-150400.4.76.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5php8-test8.0.30-150400.4.76.2
SUSE Linux Enterprise Server for SAP Applications 15 SP6apache2-mod_php77.4.33-150400.4.81.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6apache2-mod_php88.2.34-150600.3.36.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6php77.4.33-150400.4.81.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6php7-fastcgi7.4.33-150400.4.81.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6php7-fpm7.4.33-150400.4.81.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6php88.2.34-150600.3.36.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6php8-embed8.2.34-150600.3.36.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6php8-fastcgi8.2.34-150600.3.36.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6php8-fpm8.2.34-150600.3.36.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6php8-test8.2.34-150600.3.36.1
SUSE Linux Enterprise Server for SAP applications 16.0apache2-mod_php88.4.26-160000.1.1
SUSE Linux Enterprise Server for SAP applications 16.0php88.4.26-160000.1.1
SUSE Linux Enterprise Server for SAP applications 16.0php8-embed8.4.26-160000.1.1
SUSE Linux Enterprise Server for SAP applications 16.0php8-fastcgi8.4.26-160000.1.1
SUSE Linux Enterprise Server for SAP applications 16.0php8-fpm8.4.26-160000.1.1
Ubuntu 22.04 LTSphp8.18.1.2-1ubuntu2.27
Ubuntu 24.04 LTSphp8.38.3.6-0ubuntu0.24.04.12
Ubuntu 26.04 LTSphp8.58.5.4-0ubuntu1.4
Ubuntu 26.10php8.58.5.9-0ubuntu2
Ubuntu Pro 14.04 LTSphp55.5.9+dfsg-1ubuntu4.29+esm17
Ubuntu Pro 16.04 LTSphp7.07.0.33-0ubuntu0.16.04.16+esm21
Ubuntu Pro 18.04 LTSphp7.27.2.24-0ubuntu0.18.04.17+esm13
Ubuntu Pro 20.04 LTSphp7.47.4.3-4ubuntu2.29+esm4
openSUSE Leap 16.0apache2-mod_php88.4.26-160000.1.1
openSUSE Leap 16.0php88.4.26-160000.1.1
openSUSE Leap 16.0php8-embed8.4.26-160000.1.1
openSUSE Leap 16.0php8-fastcgi8.4.26-160000.1.1
openSUSE Leap 16.0php8-fpm8.4.26-160000.1.1
openSUSE Leap 16.0php8-test8.4.26-160000.1.1
openSUSE Tumbleweedphp88.5.11-1.1