Denial of Service in WordPress HTTP API Relative URL Resolution

WP_Http::make_absolute_url() can enter an infinite loop when resolving a crafted relative path (for example one containing an empty segment before '../'). A hostile remote server can return such a path in a redirect Location header, tying up PHP workers until max_execution_time and degrading site availability. Weiterlesen: Denial of Service in WordPress HTTP API Relative URL Resolution