Orta CVSS 5.8 PoC var
CVE-2026-93682: Php: sınır dışı okuma
Açıklama (NVD)
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory.
Özet bilgiler
- Ürün
- Php Php
- CVSS v3.1
- 5.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N - EPSS
- %0,34 (yüzdelik 27)
- CWE
- CWE-125
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| php-php | 8.2.0 | — | 8.2.34 |
| php-php | 8.3.0 | — | 8.3.35 |
| php-php | 8.4.0 | — | 8.4.26 |
| php-php | 8.5.0 | — | 8.5.11 |