Vulnerability-Lookup

RHSA-2026:87080

Vulnerability from csaf_redhat - Published: 2026-10-21 15:53 - Updated: 2026-10-21 21:34

Summary

Red Hat Security Advisory: php:7.4 security update

Severity

Important

Notes

Topic: An update for the php:7.4 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: php: Out-of-bounds read via empty HTTP redirect Location header (CVE-2026-93682) * php: PHP: Archive entry injection via integer overflow in TAR parser (CVE-2026-6103) * php: PHP: Denial of Service via heap buffer overflow in SOAP client (CVE-2025-14181) * php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765) * php: php: Credential disclosure via cross-origin HTTP redirects (CVE-2026-91766) * php: php: Information disclosure via crafted TLS server certificate (CVE-2026-91767) * php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser (CVE-2025-1218) * php: php: Access control bypass via partial IPv6 address comparison (CVE-2026-91768) * php: php: Information disclosure via out-of-bounds read in stream filters (CVE-2026-92842) * php: php: Server impersonation via Common Name fallback in TLS verification (CVE-2026-91769) * php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618) * php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2025-1218

A flaw was found in PHP. The MySQL Native Driver (mysqlnd) wire protocol parser fails to verify that an incoming packet contains enough bytes before reading its fields. A malicious or compromised database server can send a truncated packet, causing the client application to read past the buffer boundary. This issue can lead to a process crash, resulting in a Denial of Service (DoS), or potentially leak sensitive memory.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 301 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:apcu-panel-0:5.1.18-1.module+el8.10.0+22485+a3539972.noarch::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-0:1.6.1-1.module+el8.10.0+22485+a3539972.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-0:1.6.1-1.module+el8.10.0+22485+a3539972.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-0:1.6.1-1.module+el8.10.0+22485+a3539972.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-0:1.6.1-1.module+el8.10.0+22485+a3539972.src::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-0:1.6.1-1.module+el8.10.0+22485+a3539972.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-debuginfo-0:1.6.1-1.module+el8.10.0+22485+a3539972.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-debuginfo-0:1.6.1-1.module+el8.10.0+22485+a3539972.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-debuginfo-0:1.6.1-1.module+el8.10.0+22485+a3539972.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-debuginfo-0:1.6.1-1.module+el8.10.0+22485+a3539972.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-debugsource-0:1.6.1-1.module+el8.10.0+22485+a3539972.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-debugsource-0:1.6.1-1.module+el8.10.0+22485+a3539972.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-debugsource-0:1.6.1-1.module+el8.10.0+22485+a3539972.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-debugsource-0:1.6.1-1.module+el8.10.0+22485+a3539972.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-devel-0:1.6.1-1.module+el8.10.0+22485+a3539972.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-devel-0:1.6.1-1.module+el8.10.0+22485+a3539972.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-devel-0:1.6.1-1.module+el8.10.0+22485+a3539972.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-devel-0:1.6.1-1.module+el8.10.0+22485+a3539972.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-tools-0:1.6.1-1.module+el8.10.0+22485+a3539972.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-tools-0:1.6.1-1.module+el8.10.0+22485+a3539972.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-tools-0:1.6.1-1.module+el8.10.0+22485+a3539972.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-tools-0:1.6.1-1.module+el8.10.0+22485+a3539972.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-tools-debuginfo-0:1.6.1-1.module+el8.10.0+22485+a3539972.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-tools-debuginfo-0:1.6.1-1.module+el8.10.0+22485+a3539972.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-tools-debuginfo-0:1.6.1-1.module+el8.10.0+22485+a3539972.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-tools-debuginfo-0:1.6.1-1.module+el8.10.0+22485+a3539972.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-0:7.4.33-8.module+el8.10.0+25117+30337cca.src::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-bcmath-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-bcmath-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-bcmath-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-bcmath-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-bcmath-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-bcmath-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-bcmath-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-bcmath-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-cli-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-cli-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-cli-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-cli-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-cli-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-cli-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-cli-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-cli-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-common-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-common-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-common-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-common-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-common-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-common-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-common-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-common-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dba-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dba-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dba-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dba-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dba-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dba-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dba-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dba-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dbg-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dbg-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dbg-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dbg-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dbg-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dbg-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dbg-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dbg-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-debugsource-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-debugsource-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-debugsource-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-debugsource-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-devel-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-devel-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-devel-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-devel-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-embedded-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-embedded-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-embedded-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-embedded-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-embedded-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-embedded-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-embedded-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-embedded-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-enchant-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-enchant-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-enchant-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-enchant-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-enchant-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-enchant-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-enchant-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-enchant-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ffi-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ffi-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ffi-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ffi-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ffi-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ffi-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ffi-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ffi-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-fpm-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-fpm-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-fpm-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-fpm-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-fpm-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-fpm-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-fpm-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-fpm-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gd-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gd-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gd-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gd-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gd-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gd-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gd-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gd-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gmp-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gmp-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gmp-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gmp-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gmp-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gmp-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gmp-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gmp-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-intl-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-intl-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-intl-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-intl-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-intl-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-intl-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-intl-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-intl-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-json-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-json-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-json-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-json-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-json-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-json-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-json-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-json-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ldap-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ldap-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ldap-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ldap-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ldap-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ldap-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ldap-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ldap-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mbstring-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mbstring-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mbstring-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mbstring-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mbstring-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mbstring-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mbstring-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mbstring-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mysqlnd-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mysqlnd-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mysqlnd-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mysqlnd-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mysqlnd-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mysqlnd-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mysqlnd-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mysqlnd-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-odbc-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-odbc-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-odbc-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-odbc-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-odbc-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-odbc-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-odbc-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-odbc-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-opcache-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-opcache-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-opcache-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-opcache-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-opcache-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-opcache-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-opcache-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-opcache-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pdo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pdo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pdo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pdo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pdo-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pdo-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pdo-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pdo-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pear-1:1.10.13-1.module+el8.10.0+22485+a3539972.noarch::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pear-1:1.10.13-1.module+el8.10.0+22485+a3539972.src::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-0:5.1.18-1.module+el8.10.0+22485+a3539972.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-0:5.1.18-1.module+el8.10.0+22485+a3539972.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-0:5.1.18-1.module+el8.10.0+22485+a3539972.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-0:5.1.18-1.module+el8.10.0+22485+a3539972.src::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-0:5.1.18-1.module+el8.10.0+22485+a3539972.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-debuginfo-0:5.1.18-1.module+el8.10.0+22485+a3539972.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-debuginfo-0:5.1.18-1.module+el8.10.0+22485+a3539972.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-debuginfo-0:5.1.18-1.module+el8.10.0+22485+a3539972.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-debuginfo-0:5.1.18-1.module+el8.10.0+22485+a3539972.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-debugsource-0:5.1.18-1.module+el8.10.0+22485+a3539972.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-debugsource-0:5.1.18-1.module+el8.10.0+22485+a3539972.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-debugsource-0:5.1.18-1.module+el8.10.0+22485+a3539972.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-debugsource-0:5.1.18-1.module+el8.10.0+22485+a3539972.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-devel-0:5.1.18-1.module+el8.10.0+22485+a3539972.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-devel-0:5.1.18-1.module+el8.10.0+22485+a3539972.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-devel-0:5.1.18-1.module+el8.10.0+22485+a3539972.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-devel-0:5.1.18-1.module+el8.10.0+22485+a3539972.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-0:2.0.1-1.module+el8.10.0+22485+a3539972.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-0:2.0.1-1.module+el8.10.0+22485+a3539972.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-0:2.0.1-1.module+el8.10.0+22485+a3539972.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-0:2.0.1-1.module+el8.10.0+22485+a3539972.src::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-0:2.0.1-1.module+el8.10.0+22485+a3539972.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-debuginfo-0:2.0.1-1.module+el8.10.0+22485+a3539972.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-debuginfo-0:2.0.1-1.module+el8.10.0+22485+a3539972.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-debuginfo-0:2.0.1-1.module+el8.10.0+22485+a3539972.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-debuginfo-0:2.0.1-1.module+el8.10.0+22485+a3539972.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-debugsource-0:2.0.1-1.module+el8.10.0+22485+a3539972.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-debugsource-0:2.0.1-1.module+el8.10.0+22485+a3539972.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-debugsource-0:2.0.1-1.module+el8.10.0+22485+a3539972.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-debugsource-0:2.0.1-1.module+el8.10.0+22485+a3539972.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug-0:2.9.5-1.module+el8.10.0+22485+a3539972.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug-0:2.9.5-1.module+el8.10.0+22485+a3539972.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug-0:2.9.5-1.module+el8.10.0+22485+a3539972.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug-0:2.9.5-1.module+el8.10.0+22485+a3539972.src::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug-0:2.9.5-1.module+el8.10.0+22485+a3539972.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug-debuginfo-0:2.9.5-1.module+el8.10.0+22485+a3539972.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug-debuginfo-0:2.9.5-1.module+el8.10.0+22485+a3539972.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug-debuginfo-0:2.9.5-1.module+el8.10.0+22485+a3539972.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug-debuginfo-0:2.9.5-1.module+el8.10.0+22485+a3539972.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug-debugsource-0:2.9.5-1.module+el8.10.0+22485+a3539972.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug-debugsource-0:2.9.5-1.module+el8.10.0+22485+a3539972.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug-debugsource-0:2.9.5-1.module+el8.10.0+22485+a3539972.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug-debugsource-0:2.9.5-1.module+el8.10.0+22485+a3539972.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-0:1.18.2-1.module+el8.10.0+22485+a3539972.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-0:1.18.2-1.module+el8.10.0+22485+a3539972.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-0:1.18.2-1.module+el8.10.0+22485+a3539972.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-0:1.18.2-1.module+el8.10.0+22485+a3539972.src::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-0:1.18.2-1.module+el8.10.0+22485+a3539972.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-debuginfo-0:1.18.2-1.module+el8.10.0+22485+a3539972.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-debuginfo-0:1.18.2-1.module+el8.10.0+22485+a3539972.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-debuginfo-0:1.18.2-1.module+el8.10.0+22485+a3539972.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-debuginfo-0:1.18.2-1.module+el8.10.0+22485+a3539972.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-debugsource-0:1.18.2-1.module+el8.10.0+22485+a3539972.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-debugsource-0:1.18.2-1.module+el8.10.0+22485+a3539972.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-debugsource-0:1.18.2-1.module+el8.10.0+22485+a3539972.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-debugsource-0:1.18.2-1.module+el8.10.0+22485+a3539972.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pgsql-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pgsql-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pgsql-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pgsql-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pgsql-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pgsql-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pgsql-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pgsql-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-process-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-process-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-process-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-process-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-process-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-process-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-process-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-process-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-snmp-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-snmp-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-snmp-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-snmp-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-snmp-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-snmp-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-snmp-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-snmp-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-soap-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-soap-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-soap-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-soap-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-soap-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-soap-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-soap-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-soap-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xml-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xml-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xml-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xml-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xml-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xml-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xml-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xml-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xmlrpc-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xmlrpc-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xmlrpc-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xmlrpc-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xmlrpc-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.aarch64::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xmlrpc-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.ppc64le::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xmlrpc-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.s390x::php:7.4	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xmlrpc-debuginfo-0:7.4.33-8.module+el8.10.0+25117+30337cca.x86_64::php:7.4	—	Vendor Fix fix Workaround

Threats

Impact Low

CVE-2025-14181

A flaw was found in PHP. A malicious server can cause a Denial of Service (DoS) by exploiting an improper buffer size check in the Simple Object Access Protocol (SOAP) client during HTTP response parsing. When responding to a request, the server can supply crafted data that triggers an integer calculation issue, causing the client to allocate an undersized memory buffer. As the client writes incoming data past the allocated space, a heap-based buffer overflow occurs, leading to an application crash or potential memory corruption.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 301 products, the same list as for CVE-2025-1218

Threats

Impact Moderate

CVE-2026-6103

A flaw was found in PHP. An integer overflow vulnerability in the Phar extension occurs when parsing TAR archive headers containing excessively large size fields. An attacker can exploit this issue by supplying a specially crafted archive file to an application that processes TAR archives, causing the parser to miscalculate data boundaries and treat file content as valid header data. This allows an attacker to inject unauthorized entries that the application extracts as authentic files, potentially leading to unauthorized data modification.

4.3 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 301 products, the same list as for CVE-2025-1218

Threats

Impact Moderate

CVE-2026-91765

A flaw was found in PHP. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted request to an affected Simple Object Access Protocol (SOAP) server endpoint. Due to a lack of recursion depth limits when parsing deeply nested XML elements, processing such requests exhausts system stack memory and crashes the application process.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-674 - Uncontrolled Recursion

Affected products

Fixed 301 products, the same list as for CVE-2025-1218

Threats

Impact Important

CVE-2026-91766

A flaw was found in PHP. When following a redirect, the built-in HTTP (Hypertext Transfer Protocol) stream wrapper forwards sensitive request headers—such as authentication tokens and session cookies—unchanged, even when directed to a different host, port, or unencrypted connection. A malicious server capable of steering redirects can exploit this flaw to capture sensitive credentials intended only for the original destination.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Affected products

Fixed 301 products, the same list as for CVE-2025-1218

Threats

Impact Moderate

CVE-2026-91767

A flaw was found in PHP. When validating secure connections using Transport Layer Security (TLS), an error in how wildcard domain names in server certificates are verified can lead to an out-of-bounds memory read. A malicious server presenting a specially crafted certificate can exploit this issue against a connecting PHP client. This flaw primarily leads to information disclosure, potentially exposing sensitive data stored in application memory.

6.5 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 301 products, the same list as for CVE-2025-1218

Threats

Impact Moderate

CVE-2026-91768

A flaw was found in PHP. The access control check for Internet Protocol version 6 (IPv6) addresses in the FastCGI implementation compares only the first 12 bytes of a 16-byte address instead of the complete address. An attacker on an adjacent network with an address sharing the first 96 bits with an authorized client can bypass network access restrictions to reach the FastCGI endpoint, potentially leading to unauthorized information disclosure.

6.5 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-940 - Improper Verification of Source of a Communication Channel

Affected products

Fixed 301 products, the same list as for CVE-2025-1218

Threats

Impact Moderate

CVE-2026-91769

A flaw was found in PHP. This vulnerability allows server impersonation and potential information disclosure during Transport Layer Security (TLS) connections. When verifying peer certificates, PHP improperly falls back to matching the Common Name (CN) if no Subject Alternative Name (SAN) matches the requested hostname. An attacker could exploit this flaw by presenting a certificate trusted for another domain whose CN matches the target, enabling them to impersonate a legitimate server and intercept sensitive data.

4.3 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-295 - Improper Certificate Validation

Affected products

Fixed 301 products, the same list as for CVE-2025-1218

Threats

Impact Moderate

CVE-2026-92842

A flaw was found in PHP. When processing certain conversion stream filters with line-break settings containing a null byte, the filter duplicates the string but retains the original length rather than the truncated size. An attacker who can influence filter options could exploit this out-of-bounds read, leading to information disclosure by leaking sensitive heap memory contents into the output stream.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Fixed 301 products, the same list as for CVE-2025-1218

Threats

Impact Moderate

CVE-2026-93682

A flaw was found in PHP. When the HTTP stream wrapper processes a redirect response containing an empty Location header, an out-of-bounds read occurs by accessing memory beyond the allocated buffer. A malicious server can exploit this flaw to influence the client's redirect target path, potentially routing subsequent requests to unintended locations based on adjacent heap memory.

5.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Fixed 301 products, the same list as for CVE-2025-1218

Threats

Impact Moderate

CVE-2026-109618

A flaw was found in PHP's memory limit handling during request parsing. PHP records certain state as ready for use before all required memory allocations complete. If an allocation fails due to memory exhaustion, the incomplete state is not rolled back. Subsequent cleanup operations treat the uninitialized memory as valid, leading to memory corruption. An unauthenticated attacker can exploit this via crafted HTTP requests to achieve remote code execution against mod_php with default configuration, and against FPM through application-stage paths.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 301 products, the same list as for CVE-2025-1218

Threats

Impact Important

CVE-2026-109619

A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is reset. If PHP catches the failure and continues cleanup, or reuses the persistent worker for a subsequent request, a later operation may act on the stale state after its underlying memory has been released. An unauthenticated attacker can exploit this to achieve use-after-free and remote code execution against mod_php. FPM is conditionally affected through application-stage paths.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 301 products, the same list as for CVE-2025-1218

Threats

Impact Important

References

76 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:87080	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2541615	external
https://bugzilla.redhat.com/show_bug.cgi?id=2541638	external
https://bugzilla.redhat.com/show_bug.cgi?id=2541641	external
https://bugzilla.redhat.com/show_bug.cgi?id=2541646	external
https://bugzilla.redhat.com/show_bug.cgi?id=2541649	external
https://bugzilla.redhat.com/show_bug.cgi?id=2541652	external
https://bugzilla.redhat.com/show_bug.cgi?id=2541655	external
https://bugzilla.redhat.com/show_bug.cgi?id=2541660	external
https://bugzilla.redhat.com/show_bug.cgi?id=2541662	external
https://bugzilla.redhat.com/show_bug.cgi?id=2542493	external
https://bugzilla.redhat.com/show_bug.cgi?id=2553995	external
https://bugzilla.redhat.com/show_bug.cgi?id=2554177	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2025-1218	self
https://bugzilla.redhat.com/show_bug.cgi?id=2541655	external
https://www.cve.org/CVERecord?id=CVE-2025-1218	external
https://nvd.nist.gov/vuln/detail/CVE-2025-1218	external
https://github.com/php/php-src/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2025-14181	self
https://bugzilla.redhat.com/show_bug.cgi?id=2541641	external
https://www.cve.org/CVERecord?id=CVE-2025-14181	external
https://nvd.nist.gov/vuln/detail/CVE-2025-14181	external
https://github.com/php/php-src/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-6103	self
https://bugzilla.redhat.com/show_bug.cgi?id=2541638	external
https://www.cve.org/CVERecord?id=CVE-2026-6103	external
https://nvd.nist.gov/vuln/detail/CVE-2026-6103	external
https://github.com/php/php-src/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-91765	self
https://bugzilla.redhat.com/show_bug.cgi?id=2541646	external
https://www.cve.org/CVERecord?id=CVE-2026-91765	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91765	external
https://github.com/php/php-src/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-91766	self
https://bugzilla.redhat.com/show_bug.cgi?id=2541649	external
https://www.cve.org/CVERecord?id=CVE-2026-91766	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91766	external
https://github.com/php/php-src/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-91767	self
https://bugzilla.redhat.com/show_bug.cgi?id=2541652	external
https://www.cve.org/CVERecord?id=CVE-2026-91767	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91767	external
https://github.com/php/php-src/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-91768	self
https://bugzilla.redhat.com/show_bug.cgi?id=2541660	external
https://www.cve.org/CVERecord?id=CVE-2026-91768	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91768	external
https://github.com/php/php-src/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-91769	self
https://bugzilla.redhat.com/show_bug.cgi?id=2542493	external
https://www.cve.org/CVERecord?id=CVE-2026-91769	external
https://nvd.nist.gov/vuln/detail/CVE-2026-91769	external
https://github.com/php/php-src/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-92842	self
https://bugzilla.redhat.com/show_bug.cgi?id=2541662	external
https://www.cve.org/CVERecord?id=CVE-2026-92842	external
https://nvd.nist.gov/vuln/detail/CVE-2026-92842	external
https://github.com/php/php-src/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-93682	self
https://bugzilla.redhat.com/show_bug.cgi?id=2541615	external
https://www.cve.org/CVERecord?id=CVE-2026-93682	external
https://nvd.nist.gov/vuln/detail/CVE-2026-93682	external
https://github.com/php/php-src/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-109618	self
https://bugzilla.redhat.com/show_bug.cgi?id=2553995	external
https://www.cve.org/CVERecord?id=CVE-2026-109618	external
https://nvd.nist.gov/vuln/detail/CVE-2026-109618	external
https://access.redhat.com/security/vulnerabilitie…	external
https://github.com/php/php-src/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-109619	self
https://bugzilla.redhat.com/show_bug.cgi?id=2554177	external
https://www.cve.org/CVERecord?id=CVE-2026-109619	external
https://nvd.nist.gov/vuln/detail/CVE-2026-109619	external
https://github.com/php/php-src/security/advisorie…	external

JSON

To clipboard

Loading 2.0 MB of JSON…

CVE-2025-1218 (GCVE-0-2025-1218)

Vulnerability from cvelistv5 – Published: 2026-09-25 20:48 – Updated: 2026-09-28 13:31

Title

Various packet overreads in mysqlnd_writeprotocol.c

Summary

The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.

Severity

3.4 (Low)


                        
                          CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-28 12:56 UTC

CWE

CWE-122 - Heap-based buffer overflow

Assigner

php CNA under the mitre root

CNA scorecard B 81/100 over 27 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/php/php-src/security/advisorie…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
PHP Group	PHP	Affected: 8.2.* , < 8.2.34 (semver) Affected: 8.3.* , < 8.3.35 (semver) Affected: 8.4.* , < 8.4.26 (semver) Affected: 8.5.* , < 8.5.11 (semver)

Credits

Nora Dossche @bao00065 (GitHub) @cxxz16 (GitHub) @TristanInSec (GitHub) @OSTIF-Derek (GitHub) @HO-9 (GitHub) Jakub Zelenka Nora Dossche Alexandre Daubois

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1218",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T12:56:30.325753Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T13:31:31.774Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "ext-mysqlnd",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.2.34",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.35",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.4.26",
              "status": "affected",
              "version": "8.4.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.11",
              "status": "affected",
              "version": "8.5.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Nora Dossche"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "@bao00065 (GitHub)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "@cxxz16 (GitHub)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "@TristanInSec (GitHub)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "@OSTIF-Derek (GitHub)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "@HO-9 (GitHub)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jakub Zelenka"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nora Dossche"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Alexandre Daubois"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.\u003c/p\u003e"
            }
          ],
          "value": "The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.4,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based buffer overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T20:48:21.777Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Various packet overreads in mysqlnd_writeprotocol.c",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2025-1218",
    "datePublished": "2026-09-25T20:48:21.777Z",
    "dateReserved": "2025-02-11T04:49:52.603Z",
    "dateUpdated": "2026-09-28T13:31:31.774Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14181 (GCVE-0-2025-14181)

Vulnerability from cvelistv5 – Published: 2026-09-25 20:26 – Updated: 2026-09-25 20:44

Title

Integer overflow to buffer overflow in soap HTTP parsing

Summary

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-25 20:43 UTC

CWE

CWE-190 - Integer overflow or wraparound

Assigner

php CNA under the mitre root

CNA scorecard B 81/100 over 27 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/php/php-src/security/advisorie…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
PHP Group	PHP	Affected: 8.2.* , < 8.2.34 (semver) Affected: 8.3.* , < 8.3.35 (semver) Affected: 8.4.* , < 8.4.26 (semver) Affected: 8.5.* , < 8.5.11 (semver)

Credits

Nora Dossche Nora Dossche

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14181",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T20:43:53.478398Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T20:44:13.720Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "ext-soap",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.2.34",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.35",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.4.26",
              "status": "affected",
              "version": "8.4.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.11",
              "status": "affected",
              "version": "8.5.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Nora Dossche"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nora Dossche"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.\u003c/p\u003e"
            }
          ],
          "value": "The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-128",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-128 Integer Attacks"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 Integer overflow or wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T20:26:45.445Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Integer overflow to buffer overflow in soap HTTP parsing",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2025-14181",
    "datePublished": "2026-09-25T20:26:45.445Z",
    "dateReserved": "2025-12-06T06:46:57.344Z",
    "dateUpdated": "2026-09-25T20:44:13.720Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109618 (GCVE-0-2026-109618)

Vulnerability from cvelistv5 – Published: 2026-10-21 13:48 – Updated: 2026-10-21 16:07

Title

RCE via OOM corruption

Summary

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-21 14:34 UTC

CWE

CWE-416 - Use after free
CWE-755 - Improper Handling of Exceptional Conditions
CWE-824 - Access of uninitialized pointer
CWE-1325 - Improperly controlled sequential memory allocation
CWE-1419 - Incorrect Initialization of Resource

Assigner

php CNA under the mitre root

CNA scorecard B 81/100 over 27 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/php/php-src/security/advisorie…	vendor-advisory
https://www.wiz.io/blog/php2shell-php-rce	third-party-advisory
http://www.openwall.com/lists/oss-security/2026/10/21/6

Impacted products

1 product

Vendor	Product	Version
PHP Group	PHP	Affected: 8.2.* , < 8.2.35 (semver) Affected: 8.3.* , < 8.3.36 (semver) Affected: 8.4.* , < 8.4.27 (semver) Affected: 8.5.* , < 8.5.12 (semver)

Credits

Ryan at Calif.io Wiz OpenAI Arnaud Le Blanc Ilija Tovilo Jakub Zelenka Nora Dossche

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109618",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-21T14:34:39.479770Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-21T14:36:24.229Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://www.wiz.io/blog/php2shell-php-rce"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-21T16:07:52.535Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/21/6"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "php-src",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.2.35",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.36",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.4.27",
              "status": "affected",
              "version": "8.4.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.12",
              "status": "affected",
              "version": "8.5.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ryan at Calif.io"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Wiz"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "OpenAI"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Arnaud Le Blanc"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Ilija Tovilo"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jakub Zelenka"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nora Dossche"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).\u003cbr\u003e"
            }
          ],
          "value": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE)."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-234",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-234 Hijacking a privileged process"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use after free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "CWE-755 Improper Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-824",
              "description": "CWE-824 Access of uninitialized pointer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1325",
              "description": "CWE-1325 Improperly controlled sequential memory allocation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1419",
              "description": "CWE-1419 Incorrect Initialization of Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T13:48:34.845Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "RCE via OOM corruption",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Check the GitHub Security Advisory for mitigation strategies."
            }
          ],
          "value": "Check the GitHub Security Advisory for mitigation strategies."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2026-109618",
    "datePublished": "2026-10-21T13:48:34.845Z",
    "dateReserved": "2026-10-12T21:03:58.117Z",
    "dateUpdated": "2026-10-21T16:07:52.535Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109619 (GCVE-0-2026-109619)

Vulnerability from cvelistv5 – Published: 2026-10-21 13:54 – Updated: 2026-10-21 20:08

Title

RCE via stale global state

Summary

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-21 14:34 UTC

CWE

CWE-416 - Use after free
CWE-755 - Improper Handling of Exceptional Conditions
CWE-824 - Access of uninitialized pointer
CWE-1325 - Improperly controlled sequential memory allocation
CWE-1419 - Incorrect Initialization of Resource

Assigner

php CNA under the mitre root

CNA scorecard B 81/100 over 27 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/php/php-src/security/advisorie…	vendor-advisory
https://www.wiz.io/blog/php2shell-php-rce	third-party-advisory
http://www.openwall.com/lists/oss-security/2026/10/21/7
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/1…

Impacted products

1 product

Vendor	Product	Version
PHP Group	PHP	Affected: 8.2.* , < 8.2.35 (semver) Affected: 8.3.* , < 8.3.36 (semver) Affected: 8.4.* , < 8.4.27 (semver) Affected: 8.5.* , < 8.5.12 (semver)

Credits

Wiz Ryan at Calif.io OpenAI Arnaud Le Blanc Ilija Tovilo Jakub Zelenka Nora Dossche

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109619",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-21T14:34:42.468059Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-21T14:36:19.697Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://www.wiz.io/blog/php2shell-php-rce"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-21T20:08:07.944Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/21/7"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/21/16"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/21/17"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/21/23"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "php-src",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.2.35",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.36",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.4.27",
              "status": "affected",
              "version": "8.4.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.12",
              "status": "affected",
              "version": "8.5.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Wiz"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ryan at Calif.io"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "OpenAI"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Arnaud Le Blanc"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Ilija Tovilo"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jakub Zelenka"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nora Dossche"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE)."
            }
          ],
          "value": "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE)."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-234",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-234 Hijacking a privileged process"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use after free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "CWE-755 Improper Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-824",
              "description": "CWE-824 Access of uninitialized pointer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1325",
              "description": "CWE-1325 Improperly controlled sequential memory allocation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1419",
              "description": "CWE-1419 Incorrect Initialization of Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T13:54:43.866Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "RCE via stale global state",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Check the GitHub Security Advisory for mitigation strategies."
            }
          ],
          "value": "Check the GitHub Security Advisory for mitigation strategies."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2026-109619",
    "datePublished": "2026-10-21T13:54:43.866Z",
    "dateReserved": "2026-10-12T21:04:00.504Z",
    "dateUpdated": "2026-10-21T20:08:07.944Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6103 (GCVE-0-2026-6103)

Vulnerability from cvelistv5 – Published: 2026-09-25 20:08 – Updated: 2026-09-25 20:41

Title

Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection

Summary

phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-25 20:41 UTC

CWE

CWE-190 - Integer overflow or wraparound

Assigner

php CNA under the mitre root

CNA scorecard B 81/100 over 27 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/php/php-src/security/advisorie…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
PHP Group	PHP	Affected: 8.2.* , < 8.2.34 (semver) Affected: 8.3.* , < 8.3.35 (semver) Affected: 8.4.* , < 8.4.26 (semver) Affected: 8.5.* , < 8.5.11 (semver)

Credits

@arnoldasr (GitHub) @Oblivionsage (GitHub) @OSTIF-Derek (GitHub) Jakub Zelenka Weilin Du

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6103",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T20:41:05.626504Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T20:41:27.115Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.2.34",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.35",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.4.26",
              "status": "affected",
              "version": "8.4.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.11",
              "status": "affected",
              "version": "8.5.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "@arnoldasr (GitHub)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "@Oblivionsage (GitHub)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "@OSTIF-Derek (GitHub)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jakub Zelenka"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Weilin Du"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003ccode\u003ephar_tar_number()\u003c/code\u003e parses the octal size field of a TAR header into a \u003ccode\u003euint32_t\u003c/code\u003e with no overflow check. The field is 11 octal digits wide and holds values up to \u003ccode\u003e0x1FFFFFFFF\u003c/code\u003e, so a size above \u003ccode\u003e0xFFFFFFFF\u003c/code\u003e silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that \u003ccode\u003ePharData\u003c/code\u003e reports and extracts as if they were genuine.\u003c/p\u003e"
            }
          ],
          "value": "phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-92",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-92 Forced Integer Overflow"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 Integer overflow or wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T20:21:07.070Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2026-6103",
    "datePublished": "2026-09-25T20:08:49.333Z",
    "dateReserved": "2026-04-11T04:13:04.238Z",
    "dateUpdated": "2026-09-25T20:41:27.115Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91765 (GCVE-0-2026-91765)

Vulnerability from cvelistv5 – Published: 2026-09-25 20:33 – Updated: 2026-09-28 13:31

Title

SOAP: Unbounded Recursion in Server-Side cleanup_xml_node

Summary

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-28 12:56 UTC

CWE

CWE-674

Assigner

php CNA under the mitre root

CNA scorecard B 81/100 over 27 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/php/php-src/security/advisorie…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
PHP Group	PHP	Affected: 8.2.* , < 8.2.34 (semver) Affected: 8.3.* , < 8.3.35 (semver) Affected: 8.4.* , < 8.4.26 (semver) Affected: 8.5.* , < 8.5.11 (semver)

Credits

ExPatch_LLC Alexandre Daubois

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91765",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T12:56:08.183508Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T13:31:32.047Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "ext-soap",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.2.34",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.35",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.4.26",
              "status": "affected",
              "version": "8.4.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.11",
              "status": "affected",
              "version": "8.5.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "ExPatch_LLC"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Alexandre Daubois"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003ccode\u003ecleanup_xml_node()\u003c/code\u003e in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any \u003ccode\u003eSoapServer\u003c/code\u003e endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.\u003c/p\u003e"
            }
          ],
          "value": "cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-230",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-230 Serialized Data with Nested Payloads"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T20:33:03.634Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "SOAP: Unbounded Recursion in Server-Side cleanup_xml_node",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2026-91765",
    "datePublished": "2026-09-25T20:33:03.634Z",
    "dateReserved": "2026-09-15T00:34:01.883Z",
    "dateUpdated": "2026-09-28T13:31:32.047Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91766 (GCVE-0-2026-91766)

Vulnerability from cvelistv5 – Published: 2026-09-25 20:40 – Updated: 2026-09-28 13:31

Title

Cross-origin credential leak in HTTP stream wrapper redirects

Summary

When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f ).

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-28 12:56 UTC

CWE

Assigner

php CNA under the mitre root

CNA scorecard B 81/100 over 27 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/php/php-src/security/advisorie…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
PHP Group	PHP	Affected: 8.2.* , < 8.2.34 (semver) Affected: 8.3.* , < 8.3.35 (semver) Affected: 8.4.* , < 8.4.26 (semver) Affected: 8.5.* , < 8.5.11 (semver)

Credits

@q2a3z (GitHub) Ilia Alshanetsky Alexandre Daubois Tim Düsterhus Arnaud Le Blanc Jakub Zelenka

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91766",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T12:56:20.823835Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T13:31:31.921Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "ext-standard",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.2.34",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.35",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.4.26",
              "status": "affected",
              "version": "8.4.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.11",
              "status": "affected",
              "version": "8.5.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "@q2a3z (GitHub)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ilia Alshanetsky"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Alexandre Daubois"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Tim D\u00fcsterhus"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Arnaud Le Blanc"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Jakub Zelenka"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eWhen the \u003ccode\u003ehttp://\u003c/code\u003e stream wrapper follows a redirect it forwards the user-supplied \u003ccode\u003eAuthorization\u003c/code\u003e, \u003ccode\u003eCookie\u003c/code\u003e and \u003ccode\u003eProxy-Authorization\u003c/code\u003e headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 (\u003ca title=\"CVE-2018-1000007\" href=\"https://github.com/advisories/GHSA-g7x2-hrfp-pv5f\"\u003eCVE-2018-1000007\u003c/a\u003e).\u003c/p\u003e"
            }
          ],
          "value": "When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f )."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "CWE-200"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T20:40:25.040Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Cross-origin credential leak in HTTP stream wrapper redirects",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2026-91766",
    "datePublished": "2026-09-25T20:40:25.040Z",
    "dateReserved": "2026-09-15T00:38:24.146Z",
    "dateUpdated": "2026-09-28T13:31:31.921Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91767 (GCVE-0-2026-91767)

Vulnerability from cvelistv5 – Published: 2026-09-25 20:53 – Updated: 2026-09-28 13:31

Title

Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN

Summary

php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-28 12:56 UTC

CWE

CWE-122 - Heap-based buffer overflow

Assigner

php CNA under the mitre root

CNA scorecard B 81/100 over 27 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/php/php-src/security/advisorie…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
PHP Group	PHP	Affected: 8.2.* , < 8.2.34 (semver) Affected: 8.3.* , < 8.3.35 (semver) Affected: 8.4.* , < 8.4.26 (semver) Affected: 8.5.* , < 8.5.11 (semver)

Date Public

2026-09-25 20:49

Credits

Mohamed Sayed (flex0geek) Jakub Zelenka Arnaud Le Blanc

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91767",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T12:56:38.307648Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T13:31:31.640Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "ext-openssl",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.2.34",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.35",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.4.26",
              "status": "affected",
              "version": "8.4.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.11",
              "status": "affected",
              "version": "8.5.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Mohamed Sayed  (flex0geek)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jakub Zelenka"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Arnaud Le Blanc"
        }
      ],
      "datePublic": "2026-09-25T20:49:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003ccode\u003ephp_openssl_matches_wildcard_name()\u003c/code\u003e in \u003ccode\u003eext/openssl/xp_ssl.c\u003c/code\u003e underflows the length argument passed to \u003ccode\u003ememchr()\u003c/code\u003e when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to \u003ccode\u003eSIZE_MAX\u003c/code\u003e bytes past the end of a heap allocation. The path is reachable from any default client stream, because \u003ccode\u003everify_peer_name\u003c/code\u003e is enabled by default.\u003c/p\u003e"
            }
          ],
          "value": "php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based buffer overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T20:53:42.587Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2026-91767",
    "datePublished": "2026-09-25T20:53:42.587Z",
    "dateReserved": "2026-09-15T00:41:16.041Z",
    "dateUpdated": "2026-09-28T13:31:31.640Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91768 (GCVE-0-2026-91768)

Vulnerability from cvelistv5 – Published: 2026-09-25 21:07 – Updated: 2026-09-28 13:31

Title

IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

Summary

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-28 12:57 UTC

CWE

CWE-1023

Assigner

php CNA under the mitre root

CNA scorecard B 81/100 over 27 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/php/php-src/security/advisorie…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
PHP Group	PHP	Affected: 8.2.* , < 8.2.34 (semver) Affected: 8.3.* , < 8.3.35 (semver) Affected: 8.4.* , < 8.4.26 (semver) Affected: 8.5.* , < 8.5.11 (semver)

Credits

@l8BL (GitHub) @OSTIF-Derek (GitHub) Ilia Alshanetsky Alexandre Daubois Arnaud Le Blanc Jakub Zelenka

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91768",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T12:57:04.931780Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T13:31:31.382Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "PHP-FPM",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.2.34",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.35",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.4.26",
              "status": "affected",
              "version": "8.4.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.11",
              "status": "affected",
              "version": "8.5.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "@l8BL (GitHub)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "@OSTIF-Derek (GitHub)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ilia Alshanetsky"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Alexandre Daubois"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Arnaud Le Blanc"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Jakub Zelenka"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so \u003ccode\u003elisten.allowed_clients\u003c/code\u003e matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.\u003c/p\u003e"
            }
          ],
          "value": "The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1023",
              "description": "CWE-1023",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T21:07:30.950Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2026-91768",
    "datePublished": "2026-09-25T21:07:30.950Z",
    "dateReserved": "2026-09-15T00:42:30.045Z",
    "dateUpdated": "2026-09-28T13:31:31.382Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91769 (GCVE-0-2026-91769)

Vulnerability from cvelistv5 – Published: 2026-09-25 20:59 – Updated: 2026-10-04 16:10

Title

TLS Hostname Verification Falls Back to CN After SAN Mismatch

Summary

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-28 12:56 UTC

CWE

CWE-297 - Improper validation of certificate with host mismatch

Assigner

php CNA under the mitre root

CNA scorecard B 81/100 over 27 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/php/php-src/security/advisorie…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
PHP Group	PHP	Affected: 8.2.* , < 8.2.34 (semver) Affected: 8.3.* , < 8.3.35 (semver) Affected: 8.4.* , < 8.4.26 (semver) Affected: 8.5.* , < 8.5.11 (semver)

Credits

Cantina (https://www.cantina.security/) David Korczynski Jakub Zelenka Arnaud Le Blanc Alexandre Daubois @benzdeus (GitHub)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91769",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T12:56:47.310384Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T13:31:31.508Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "ext-openssl",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.2.34",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.35",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.4.26",
              "status": "affected",
              "version": "8.4.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.11",
              "status": "affected",
              "version": "8.5.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Cantina (https://www.cantina.security/)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "David Korczynski"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jakub Zelenka"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Arnaud Le Blanc"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Alexandre Daubois"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "@benzdeus (GitHub)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ePHP\u0027s OpenSSL stream peer verification checks the certificate\u0027s subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested \u003ccode\u003epeer_name\u003c/code\u003e. A certificate trusted by the client for one name can therefore be used to impersonate another.\u003c/p\u003e"
            }
          ],
          "value": "PHP\u0027s OpenSSL stream peer verification checks the certificate\u0027s subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-94",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-94"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-297",
              "description": "CWE-297 Improper validation of certificate with host mismatch",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-04T16:10:05.639Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "TLS Hostname Verification Falls Back to CN After SAN Mismatch",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2026-91769",
    "datePublished": "2026-09-25T20:59:39.727Z",
    "dateReserved": "2026-09-15T00:44:10.816Z",
    "dateUpdated": "2026-10-04T16:10:05.639Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:87080

CVE-2025-1218 (GCVE-0-2025-1218)

CVE-2025-14181 (GCVE-0-2025-14181)

CVE-2026-109618 (GCVE-0-2026-109618)

CVE-2026-109619 (GCVE-0-2026-109619)

CVE-2026-6103 (GCVE-0-2026-6103)

CVE-2026-91765 (GCVE-0-2026-91765)

CVE-2026-91766 (GCVE-0-2026-91766)

CVE-2026-91767 (GCVE-0-2026-91767)

CVE-2026-91768 (GCVE-0-2026-91768)

CVE-2026-91769 (GCVE-0-2026-91769)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour