CVE-2025-1218 — Various packet overreads in mysqlnd_writeprotocol.c

Affected: PHP Group PHP

The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.

USN-8936-1 — php8.5, php8.3, php8.1, php7.4, php7.2, php7.0, php5 vulnerabilities

Affected: Ubuntu:Pro:14.04:LTS: php5, Ubuntu:Pro:16.04:LTS: php7.0, Ubuntu:Pro:18.04:LTS: php7.2, Ubuntu:Pro:20.04:LTS: php7.4, Ubuntu:22.04:LTS: php8.1, Ubuntu:24.04:LTS: php8.3, Ubuntu:26.10: php8.5, Ubuntu:26.04:LTS: php8.5

It was discovered that PHP did not properly validate the size of MySQL server packets in the mysqlnd driver. A malicious server could possibly use this issue to cause PHP to crash, resulting in a denial of service. This issue was only addressed in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2025-1218)

It was discovered that PHP incorrectly handled response buffer sizes in the SOAP HTTP client. A malicious server could possibly use this issue to cause PHP to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2025-14181)

It was discovered that PHP incorrectly handled certain TAR archive headers in the Phar extension. An attacker could possibly use this issue to inject arbitrary files into a crafted archive. (CVE-2026-6103)

It was discovered that PHP did not limit recursion depth when parsing certain SOAP requests. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2026-91765)

It was discovered that PHP incorrectly handled authentication headers when following HTTP redirects. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-91766)

It was discovered that PHP incorrectly handled wildcard names in TLS server certificates. A malicious server could possibly use this issue to cause PHP to crash, resulting in a denial of service. This issue did not affect Ubuntu 14.04 LTS. (CVE-2026-91767)

It was discovered…

Most recent entries from all

CVE-2025-1218 — Various packet overreads in mysqlnd_writeprotocol.c

USN-8936-1 — php8.5, php8.3, php8.1, php7.4, php7.2, php7.0, php5 vulnerabilities