Invalid input to pdo_pgsql with PDO::ATTR_EMULATE_PREPARES enabled triggers a NULL pointer dereference (crash).
Affected versions
| Branch | Affected | Fixed in |
|---|---|---|
| PHP 8.5 | < 8.5.1 | 8.5.1 |
| PHP 8.4 | < 8.4.16 | 8.4.16 |
| PHP 8.3 | < 8.3.29 | 8.3.29 |
| PHP 8.2 | < 8.2.30 | 8.2.30 |
| PHP 8.1 | < 8.1.34 | 8.1.34 |
Older branches: not assessed
Exploitation conditions
- PDO PostgreSQL driver with emulated prepares
Remediation
Upgrade to 8.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1 or a later release of your branch. If your branch is end-of-life, move to a supported branch. Distribution packages may carry a backported fix under an older version number; confirm with your vendor's security tracker.
A version number alone cannot prove patch status. Linux distributions and hosting providers often backport security fixes without changing the version. Check your vendor’s changelog.
Severity scores
No CVSS score recorded in our dataset yet. Check NVD for the latest scoring.
References
Data provenance
Secondary sources · pending primary verificationLast reviewed: Oct 24, 2026 · Source
Notes: Assembled from secondary sources. Publication date reflects the upstream fix release (8.1.34 was the final 8.1 release).