- CVE-2026-93682: out-of-bounds read in the http:// wrapper when a redirect response carries an empty Location header. The relative-redirect test in ext/standard/http_fopen_wrapper.c read location[1] on a one-byte allocation and could build the redirect target from adjacent heap bytes. Backports the net effect of upstream 8196275 and its follow-up de3436c: both checks now use header_info.location_len, and the relative join is taken only when location_len > 1 (the end state, so the intermediate "> 0" form that regressed single-character Location values is never present here). Adds both upstream .phpt tests, adapted for 5.2 (no nowdoc, no function-call array dereference, dirname(__FILE__), ServerClientTestCase2.inc); %check picks them up automatically from this patch