CVE-2026-93682

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An out-of-bounds read occurs in the HTTP stream wrapper when following a redirect where the response contains a Location header with an empty value. The redirect code reads one byte beyond the end of the heap buffer storing the location. A malicious server can leverage the value of this byte to control whether the client is redirected to the host root or the current directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.