Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-91766: When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Pro

37
This week
MEDIUM 5.9REMOTEUPGRADE

CVE-2026-91766 is a medium-severity flaw (CVSS 5.9) affecting php. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://

Why this priority

  • Public exploit reference
  • Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score5.9 (Medium)
Attack vectorNetwork (remote)
Attack complexityHigh
Privileges neededNone
User interactionNone
EPSS exploit chance0.3% (top 73%)
CISA exploited listNo
WeaknessCWE-200, CWE-522
Published2026-09-25
Last modified2026-10-23
Publisher (CNA): PHP Group · Vendor: php

Am I affected?

Timeline

php php UPGRADE
Affected: >= 8.2.0 and < 8.2.34 · >= 8.3.0 and < 8.3.35 · >= 8.4.0 and < 8.4.26 · >= 8.5.0 and < 8.5.11
Fixed in: 8.2.34, 8.3.35, 8.4.26, 8.5.11
Safe to downgrade to: a release before 8.2.0
1. Check installed version
apt-cache policy php || rpm -q php || php --version
2. UPGRADE to 8.2.34 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade php
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade php
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 8.2.0 (Debian / Ubuntu)
apt-cache madison php sudo apt install php=<VERSION_BEFORE_8.2.0> sudo apt-mark hold php
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list php sudo dnf downgrade php-<VERSION_BEFORE_8.2.0> sudo dnf versionlock add php
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

Fedora 46 · wasmedge · FIXED · 0.18.1-1.fc46 · FEDORA-2026-4c27216e39 · source
sudo dnf upgrade --advisory=FEDORA-2026-4c27216e39
Ubuntu 20.04 · php7.4 · FIXED · 7.4.3-4ubuntu2.29+esm4
sudo apt update && sudo apt install --only-upgrade php7.4 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php7.4)" ge "7.4.3-4ubuntu2.29+esm4" && echo PATCHED || echo STILL-VULNERABLE
Ubuntu 22.04 · php8.1 · FIXED · 8.1.2-1ubuntu2.27
sudo apt update && sudo apt install --only-upgrade php8.1 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php8.1)" ge "8.1.2-1ubuntu2.27" && echo PATCHED || echo STILL-VULNERABLE
Ubuntu 24.04 · php8.3 · FIXED · 8.3.6-0ubuntu0.24.04.12
sudo apt update && sudo apt install --only-upgrade php8.3 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php8.3)" ge "8.3.6-0ubuntu0.24.04.12" && echo PATCHED || echo STILL-VULNERABLE
Debian 12 · php8.2 · FIXED · 8.2.34-1~deb12u1
sudo apt update && sudo apt install --only-upgrade php8.2 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php8.2)" ge "8.2.34-1~deb12u1" && echo PATCHED || echo STILL-VULNERABLE
Debian 13 · php8.4 · FIXED · 8.4.26-1~deb13u1
sudo apt update && sudo apt install --only-upgrade php8.4 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php8.4)" ge "8.4.26-1~deb13u1" && echo PATCHED || echo STILL-VULNERABLE
RHEL 10 · php · DEFERRED
RHEL 10 · php8.4 · DEFERRED
RHEL 6 · php · DEFERRED
RHEL 7 · php · DEFERRED
RHEL 8 · php:8.2/php · DEFERRED
Alpine 3.22 · php82 · FIXED · php82-8.2.35-r0
apk add --upgrade php82 apk info -v php82
Alpine 3.22 · php83 · FIXED · php83-8.3.36-r0
apk add --upgrade php83 apk info -v php83
Alpine 3.22 · php84 · FIXED · php84-8.4.27-r0
apk add --upgrade php84 apk info -v php84
Alpine 3.23 · php83 · FIXED · php83-8.3.36-r0
apk add --upgrade php83 apk info -v php83
Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2026-3164 · source
sudo dnf update --advisory=ALAS2023-2026-3164

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Advisories and coverage

Official advisories

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-91766?

php: upgrade to 8.2.34, 8.3.35, 8.4.26, 8.5.11. Exact commands for each OS are on this page.

Is CVE-2026-91766 being exploited?

CVE-2026-91766 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-91766 affect?

CVE-2026-91766 affects php. Severity is medium (CVSS 5.9). When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS

How urgent is CVE-2026-91766?

Priority 37/100. Public exploit reference; Remotely exploitable, no login, no user action

Software pages

PHP vulnerabilities · curl vulnerabilities

Related CVEs

References

← Back to latest CVEs