한국어
Resources

PHP security advisories

Curated PHP engine (php-src) vulnerabilities with affected ranges, fixed versions and source links. Search or filter below, or check a specific version.

Check a version Search advisories

58 advisories

AdvisorySeverityFixed inPublished
CVE-2026-109618Remote code execution via memory corruption during out-of-memory handlingCritical 9.28.2.35, 8.3.36, 8.4.27, 8.5.12
CVE-2026-109619Remote code execution via stale global state (use-after-free)Critical 9.28.2.35, 8.3.36, 8.4.27, 8.5.12
CVE-2026-17545Windows reserved device names accepted in pathsNot rated8.2.34, 8.3.35, 8.4.26, 8.5.11
CVE-2026-6103Integer overflow in Phar TAR size handlingNot rated8.2.34, 8.3.35, 8.4.26, 8.5.11
CVE-2026-91765Unbounded recursion in SOAP XML cleanupHigh 7.58.2.34, 8.3.35, 8.4.26, 8.5.11
CVE-2026-91766HTTP stream wrapper leaks credentials on cross-origin redirectsNot rated8.2.34, 8.3.35, 8.4.26, 8.5.11
CVE-2026-91767Out-of-bounds read in OpenSSL wildcard certificate name matchingNot rated8.2.34, 8.3.35, 8.4.26, 8.5.11
CVE-2026-91768PHP-FPM listen.allowed_clients IPv6 ACL bypassNot rated8.2.34, 8.3.35, 8.4.26, 8.5.11
CVE-2026-91769TLS hostname verification falls back to certificate CNNot rated8.2.34, 8.3.35, 8.4.26, 8.5.11
CVE-2026-92842Over-read in stream filter line-break-chars handlingMedium 5.98.2.34, 8.3.35, 8.4.26, 8.5.11
CVE-2026-17543SQL injection in pg_insert/pg_update/pg_select/pg_deleteHigh8.2.33, 8.3.33, 8.4.24, 8.5.9
CVE-2026-17544Out-of-bounds write in BCMath bccomp()Not rated8.4.24, 8.5.9
CVE-2026-7260Phar crash on recursive symlinksNot rated8.2.33, 8.3.33, 8.4.24, 8.5.9
CVE-2026-12184Crash during TLS stream cleanupMedium 5.98.2.32, 8.3.32, 8.4.23, 8.5.8
CVE-2026-14355Heap corruption in openssl_encrypt() with AES-WRAP-PADNot rated8.2.32, 8.3.32, 8.4.23, 8.5.8
CVE-2026-6104mbstring out-of-bounds read with NUL byte in encoding nameNot rated8.2.31, 8.3.31, 8.4.21, 8.5.6
CVE-2026-6722Use-after-free in the SOAP extensionCritical 9.88.2.31, 8.3.31, 8.4.21, 8.5.6
CVE-2026-6735Cross-site scripting in the PHP-FPM status pageNot rated8.2.31, 8.3.31, 8.4.21, 8.5.6
CVE-2026-7261Use-after-free in SoapServer session persistenceNot rated8.2.31, 8.3.31, 8.4.21, 8.5.6
CVE-2026-7263Infinite loop in DOMNode::C14N()Not rated8.2.31, 8.3.31, 8.4.21, 8.5.6
CVE-2025-14177getimagesize() leaks uninitialized heap memoryMedium8.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1
CVE-2025-14178Heap overflow in array_merge()High 8.28.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1
CVE-2025-14180NULL pointer dereference in pdo_pgsql with emulated preparesNot rated8.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1
CVE-2025-1220NUL byte in hostname accepted by fsockopen() and similar functionsMedium 5.38.1.33, 8.2.29, 8.3.23, 8.4.10
CVE-2025-1735Unchecked errors in pgsql escaping functionsHigh 7.58.1.33, 8.2.29, 8.3.23, 8.4.10
CVE-2025-6491NULL pointer dereference in SoapVar with oversized qualified namesMedium 5.98.1.33, 8.2.29, 8.3.23, 8.4.10
CVE-2025-1217Folded HTTP response headers mishandledMedium 6.38.1.32, 8.2.28, 8.3.19, 8.4.5
CVE-2025-1219Wrong charset used for libxml documents fetched through redirectsMedium 5.38.1.32, 8.2.28, 8.3.19, 8.4.5
CVE-2025-1734Header lines without a colon accepted as validMedium 6.38.1.32, 8.2.28, 8.3.19, 8.4.5
CVE-2025-1736Incomplete end-of-line validation in user-supplied HTTP headersMedium 6.38.1.32, 8.2.28, 8.3.19, 8.4.5
CVE-2025-1861Redirect Location header truncated at 1024 bytesMedium 6.38.1.32, 8.2.28, 8.3.19, 8.4.5
CVE-2024-11233Buffer over-read in convert.quoted-printable-decode filterHigh 8.28.1.31, 8.2.26, 8.3.14
CVE-2024-11234CRLF injection via proxy with request_fulluriHigh 7.28.1.31, 8.2.26, 8.3.14
CVE-2024-11236Integer overflow in pdo_dblib and pdo_firebird quoters (32-bit)Critical 9.88.1.31, 8.2.26, 8.3.14
CVE-2024-8929Heap over-read in mysqlnd from a hostile serverMedium 5.88.1.31, 8.2.26, 8.3.14
CVE-2024-8932Out-of-bounds write in ldap_escape() (32-bit)Critical 9.88.1.31, 8.2.26, 8.3.14
CVE-2024-8925Multipart form-data boundary handling flawMedium 5.38.1.30, 8.2.24, 8.3.12
CVE-2024-8926Bypass of the CVE-2024-4577 fix in PHP-CGI on WindowsHigh 8.88.1.30, 8.2.24, 8.3.12
CVE-2024-8927cgi.force_redirect bypass via Redirect-Status headerHigh 7.58.1.30, 8.2.24, 8.3.12
CVE-2024-9026PHP-FPM log manipulation with catch_workers_outputLow 3.38.1.30, 8.2.24, 8.3.12
CVE-2024-4577PHP-CGI argument injection on Windows (Best-Fit mapping)Critical 9.88.1.29, 8.2.20, 8.3.8
CVE-2024-5585proc_open() command injection on Windows (incomplete CVE-2024-1874 fix)High 8.88.1.29, 8.2.20, 8.3.8
CVE-2024-5458filter_var() FILTER_VALIDATE_URL accepts invalid user infoMedium 5.38.1.29, 8.2.20, 8.3.8
CVE-2024-1874proc_open() command injection on WindowsCritical 9.48.1.28, 8.2.18, 8.3.6
CVE-2024-2756__Host-/__Secure- cookie prefix bypass (incomplete CVE-2022-31629 fix)Medium 6.58.1.28, 8.2.18, 8.3.6
CVE-2024-3096password_verify() accepts empty password for hashes starting with NULMedium 6.58.1.28, 8.2.18, 8.3.6
CVE-2023-3823XXE via libxml global stateHigh 8.68.0.30, 8.1.22, 8.2.9
CVE-2023-3824Buffer overflow in phar directory readingCritical 9.88.0.30, 8.1.22, 8.2.9
CVE-2023-0567password_verify() accepts some invalid Blowfish hashesMedium 6.28.0.28, 8.1.16, 8.2.3
CVE-2023-0568Off-by-one in core path resolutionHigh 8.18.0.28, 8.1.16, 8.2.3
CVE-2023-0662Denial of service via excessive multipart partsHigh 7.58.0.28, 8.1.16, 8.2.3
CVE-2022-31630Out-of-bounds read with imageloadfont()High 7.17.4.33, 8.0.25, 8.1.12
CVE-2022-37454Buffer overflow in bundled SHA-3 (Keccak XKCP) codeCritical 9.87.4.33, 8.0.25, 8.1.12
CVE-2022-31628Infinite loop decompressing gzip phar archivesMedium 5.57.4.31, 8.0.24, 8.1.11
CVE-2022-31629__Host-/__Secure- cookie prefix bypassMedium 6.57.4.31, 8.0.24, 8.1.11
CVE-2022-31625Uninitialized free in pg_query_params()High 8.17.4.30, 8.0.20, 8.1.7
CVE-2022-31626Buffer overflow in mysqlnd with long passwordsHigh 7.57.4.30, 8.0.20, 8.1.7
CVE-2019-11043PHP-FPM remote code execution with certain nginx configurationsCritical 7.57.1.33, 7.2.24, 7.3.11