HTTP response misinterpretation via folded-header parsing

Improper input validation in PHP's HTTP stream wrapper allows remote attackers to cause response-header and MIME-type misinterpretation. The parser treats each newline as a header boundary instead of replacing an obsolete folded continuation with spaces, so it reports the continuation as a separate header. Exploitation requires PHP code to retrieve a response from an attacker-controlled or intercepted HTTP server; affected code can select the wrong MIME type or associate headers with the wrong redirected response.