An out-of-bounds read occurs in the HTTP stream wrapper when following a redirect where the response contains a `Location` header with an empty value. The redirect code reads one byte beyond the end of the heap buffer storing the location. A malicious server can leverage the value of this byte to control whether the client is redirected to the host root or the current directory.