English
자료

PHP 보안 권고

영향 범위, 수정 버전, 출처 링크를 정리한 PHP 엔진(php-src) 취약점 목록입니다. 아래에서 검색·필터링하거나 특정 버전을 점검하세요.

버전 점검하기 보안 권고 검색

보안 권고 58건

보안 권고심각도수정 버전게시일
CVE-2026-109618Remote code execution via memory corruption during out-of-memory handling치명적 9.28.2.35, 8.3.36, 8.4.27, 8.5.12
CVE-2026-109619Remote code execution via stale global state (use-after-free)치명적 9.28.2.35, 8.3.36, 8.4.27, 8.5.12
CVE-2026-17545Windows reserved device names accepted in paths미평가8.2.34, 8.3.35, 8.4.26, 8.5.11
CVE-2026-6103Integer overflow in Phar TAR size handling미평가8.2.34, 8.3.35, 8.4.26, 8.5.11
CVE-2026-91765Unbounded recursion in SOAP XML cleanup높음 7.58.2.34, 8.3.35, 8.4.26, 8.5.11
CVE-2026-91766HTTP stream wrapper leaks credentials on cross-origin redirects미평가8.2.34, 8.3.35, 8.4.26, 8.5.11
CVE-2026-91767Out-of-bounds read in OpenSSL wildcard certificate name matching미평가8.2.34, 8.3.35, 8.4.26, 8.5.11
CVE-2026-91768PHP-FPM listen.allowed_clients IPv6 ACL bypass미평가8.2.34, 8.3.35, 8.4.26, 8.5.11
CVE-2026-91769TLS hostname verification falls back to certificate CN미평가8.2.34, 8.3.35, 8.4.26, 8.5.11
CVE-2026-92842Over-read in stream filter line-break-chars handling보통 5.98.2.34, 8.3.35, 8.4.26, 8.5.11
CVE-2026-17543SQL injection in pg_insert/pg_update/pg_select/pg_delete높음8.2.33, 8.3.33, 8.4.24, 8.5.9
CVE-2026-17544Out-of-bounds write in BCMath bccomp()미평가8.4.24, 8.5.9
CVE-2026-7260Phar crash on recursive symlinks미평가8.2.33, 8.3.33, 8.4.24, 8.5.9
CVE-2026-12184Crash during TLS stream cleanup보통 5.98.2.32, 8.3.32, 8.4.23, 8.5.8
CVE-2026-14355Heap corruption in openssl_encrypt() with AES-WRAP-PAD미평가8.2.32, 8.3.32, 8.4.23, 8.5.8
CVE-2026-6104mbstring out-of-bounds read with NUL byte in encoding name미평가8.2.31, 8.3.31, 8.4.21, 8.5.6
CVE-2026-6722Use-after-free in the SOAP extension치명적 9.88.2.31, 8.3.31, 8.4.21, 8.5.6
CVE-2026-6735Cross-site scripting in the PHP-FPM status page미평가8.2.31, 8.3.31, 8.4.21, 8.5.6
CVE-2026-7261Use-after-free in SoapServer session persistence미평가8.2.31, 8.3.31, 8.4.21, 8.5.6
CVE-2026-7263Infinite loop in DOMNode::C14N()미평가8.2.31, 8.3.31, 8.4.21, 8.5.6
CVE-2025-14177getimagesize() leaks uninitialized heap memory보통8.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1
CVE-2025-14178Heap overflow in array_merge()높음 8.28.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1
CVE-2025-14180NULL pointer dereference in pdo_pgsql with emulated prepares미평가8.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1
CVE-2025-1220NUL byte in hostname accepted by fsockopen() and similar functions보통 5.38.1.33, 8.2.29, 8.3.23, 8.4.10
CVE-2025-1735Unchecked errors in pgsql escaping functions높음 7.58.1.33, 8.2.29, 8.3.23, 8.4.10
CVE-2025-6491NULL pointer dereference in SoapVar with oversized qualified names보통 5.98.1.33, 8.2.29, 8.3.23, 8.4.10
CVE-2025-1217Folded HTTP response headers mishandled보통 6.38.1.32, 8.2.28, 8.3.19, 8.4.5
CVE-2025-1219Wrong charset used for libxml documents fetched through redirects보통 5.38.1.32, 8.2.28, 8.3.19, 8.4.5
CVE-2025-1734Header lines without a colon accepted as valid보통 6.38.1.32, 8.2.28, 8.3.19, 8.4.5
CVE-2025-1736Incomplete end-of-line validation in user-supplied HTTP headers보통 6.38.1.32, 8.2.28, 8.3.19, 8.4.5
CVE-2025-1861Redirect Location header truncated at 1024 bytes보통 6.38.1.32, 8.2.28, 8.3.19, 8.4.5
CVE-2024-11233Buffer over-read in convert.quoted-printable-decode filter높음 8.28.1.31, 8.2.26, 8.3.14
CVE-2024-11234CRLF injection via proxy with request_fulluri높음 7.28.1.31, 8.2.26, 8.3.14
CVE-2024-11236Integer overflow in pdo_dblib and pdo_firebird quoters (32-bit)치명적 9.88.1.31, 8.2.26, 8.3.14
CVE-2024-8929Heap over-read in mysqlnd from a hostile server보통 5.88.1.31, 8.2.26, 8.3.14
CVE-2024-8932Out-of-bounds write in ldap_escape() (32-bit)치명적 9.88.1.31, 8.2.26, 8.3.14
CVE-2024-8925Multipart form-data boundary handling flaw보통 5.38.1.30, 8.2.24, 8.3.12
CVE-2024-8926Bypass of the CVE-2024-4577 fix in PHP-CGI on Windows높음 8.88.1.30, 8.2.24, 8.3.12
CVE-2024-8927cgi.force_redirect bypass via Redirect-Status header높음 7.58.1.30, 8.2.24, 8.3.12
CVE-2024-9026PHP-FPM log manipulation with catch_workers_output낮음 3.38.1.30, 8.2.24, 8.3.12
CVE-2024-4577PHP-CGI argument injection on Windows (Best-Fit mapping)치명적 9.88.1.29, 8.2.20, 8.3.8
CVE-2024-5585proc_open() command injection on Windows (incomplete CVE-2024-1874 fix)높음 8.88.1.29, 8.2.20, 8.3.8
CVE-2024-5458filter_var() FILTER_VALIDATE_URL accepts invalid user info보통 5.38.1.29, 8.2.20, 8.3.8
CVE-2024-1874proc_open() command injection on Windows치명적 9.48.1.28, 8.2.18, 8.3.6
CVE-2024-2756__Host-/__Secure- cookie prefix bypass (incomplete CVE-2022-31629 fix)보통 6.58.1.28, 8.2.18, 8.3.6
CVE-2024-3096password_verify() accepts empty password for hashes starting with NUL보통 6.58.1.28, 8.2.18, 8.3.6
CVE-2023-3823XXE via libxml global state높음 8.68.0.30, 8.1.22, 8.2.9
CVE-2023-3824Buffer overflow in phar directory reading치명적 9.88.0.30, 8.1.22, 8.2.9
CVE-2023-0567password_verify() accepts some invalid Blowfish hashes보통 6.28.0.28, 8.1.16, 8.2.3
CVE-2023-0568Off-by-one in core path resolution높음 8.18.0.28, 8.1.16, 8.2.3
CVE-2023-0662Denial of service via excessive multipart parts높음 7.58.0.28, 8.1.16, 8.2.3
CVE-2022-31630Out-of-bounds read with imageloadfont()높음 7.17.4.33, 8.0.25, 8.1.12
CVE-2022-37454Buffer overflow in bundled SHA-3 (Keccak XKCP) code치명적 9.87.4.33, 8.0.25, 8.1.12
CVE-2022-31628Infinite loop decompressing gzip phar archives보통 5.57.4.31, 8.0.24, 8.1.11
CVE-2022-31629__Host-/__Secure- cookie prefix bypass보통 6.57.4.31, 8.0.24, 8.1.11
CVE-2022-31625Uninitialized free in pg_query_params()높음 8.17.4.30, 8.0.20, 8.1.7
CVE-2022-31626Buffer overflow in mysqlnd with long passwords높음 7.57.4.30, 8.0.20, 8.1.7
CVE-2019-11043PHP-FPM remote code execution with certain nginx configurations치명적 7.57.1.33, 7.2.24, 7.3.11

보안 권고 상세 내용은 영어로 제공됩니다.