php-src

php-8.5.12

php/php-src

The PHP Interpreter

Compare View on GitHub

Maintenance: Active2516 commits in 3 months · bus factor 10
License: BSD-3-ClausePermissive · OSI-approved
Security: 30 advisories2 critical, 7 high, 16 medium, 5 low · Scorecard 5.4/10
Supported versions: No scheduleendoflife.date does not track this project

41.8k stars · 8.5k forks · 2.3k open issues · last release 25 days ago · data checked 3 hours ago

Overview Tour Releases Docker images Security Logos

Security advisories

All advisories on GitHub

The 30 most recent advisories published by the maintainers: 2 critical, 7 high, 16 medium, 5 low. Check the patched version against the one you run.

criticalCVE-2026-109618Oct 21, 2026
RCE via OOM corruption
Affected
< 8.2.35; < 8.3.36; < 8.4.27; < 8.5.12
Patched in
8.2.35; 8.3.36; 8.4.27; 8.5.12
criticalCVE-2026-109619Oct 21, 2026
RCE via stale global state
Affected
< 8.2.35; < 8.3.36; < 8.4.27; < 8.5.12
Patched in
8.2.35; 8.3.36; 8.4.27; 8.5.12
mediumCVE-2026-93682Sep 24, 2026
Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
Affected
<8.2.34; <8.3.35; <8.4.26; <8.5.11
Patched in
8.2.34; 8.3.35; 8.4.26; 8.5.11
mediumCVE-2026-92842Sep 24, 2026
OOB read / info leak in convert.* stream filters when line-break-chars contains NUL
Affected
<8.2.34; <8.3.35; <8.4.26; <8.5.11
Patched in
8.2.34; 8.3.35; 8.4.26; 8.5.11
lowGHSA-ch8v-r6jh-4vvrSep 24, 2026
ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED
Affected
<8.2.34; <8.3.35; <8.4.25; <8.5.10
Patched in
8.2.34; 8.3.35; 8.4.25; 8.5.10
mediumCVE-2026-91768Sep 24, 2026
IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
Affected
<8.2.34; <8.3.35; <8.4.26; <8.5.11
Patched in
8.2.34; 8.3.35; 8.4.26; 8.5.11
mediumCVE-2026-91769Sep 24, 2026
TLS Hostname Verification Falls Back to CN After SAN Mismatch
Affected
<8.2.34; <8.3.35; <8.4.26; <8.5.11
Patched in
8.2.34; 8.3.35; 8.4.26; 8.5.11
mediumCVE-2026-91767Sep 24, 2026
Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN
Affected
<8.2.34; <8.3.35; <8.4.26; <8.5.11
Patched in
8.2.34; 8.3.35; 8.4.26; 8.5.11
lowCVE-2025-1218Sep 24, 2026
Various packet overreads in mysqlnd_writeprotocol.c
Affected
<8.2.34; <8.3.35; <8.4.26; <8.5.11
Patched in
8.2.34; 8.3.35; 8.4.26; 8.5.11
mediumCVE-2026-91766Sep 24, 2026
Cross-origin credential leak in HTTP stream wrapper redirects
Affected
<8.2.34; <8.3.35; <8.4.26; <8.5.11
Patched in
8.2.34; 8.3.35; 8.4.26; 8.5.11
highCVE-2026-91765Sep 24, 2026
SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
Affected
<8.2.34; <8.3.35; <8.4.26; <8.5.11
Patched in
8.2.34; 8.3.35; 8.4.26; 8.5.11
mediumCVE-2025-14181Sep 24, 2026
Integer overflow to buffer overflow in soap HTTP parsing
Affected
<8.2.34; <8.3.35; <8.4.26; <8.5.11
Patched in
8.2.34; 8.3.35; 8.4.26; 8.5.11
mediumCVE-2026-6103Sep 24, 2026
Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection
Affected
<8.2.34; <8.3.35; <8.4.26; <8.5.11
Patched in
8.2.34; 8.3.35; 8.4.26; 8.5.11
mediumCVE-2026-17545Sep 24, 2026
PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
Affected
<8.2.34; <8.3.35; <8.4.26; <8.5.11
Patched in
8.2.34; 8.3.35; 8.4.26; 8.5.11
mediumCVE-2026-7260Jul 30, 2026
Stack overflow in phar with circular symlinks
Affected
<8.2.33; <8.3.33; <8.4.24; <8.5.9
Patched in
8.2.33; 8.3.33; 8.4.24; 8.5.9
highCVE-2026-17544Jul 30, 2026
Out-of-bounds write in bccomp() via crafted operand and scale
Affected
<8.4.24; <8.5.9
Patched in
8.4.24; 8.5.9
highCVE-2026-17543Jul 30, 2026
SQL injection in ext-pgsql via E'...' backslash breakout
Affected
<8.2.33; <8.3.33; <8.4.24; <8.5.9
Patched in
8.2.33; 8.3.33; 8.4.24; 8.5.9
highCVE-2026-12184Jul 2, 2026
Failure to setup TLS with a remote server can result in a remote DoS
Affected
< 8.3.32; < 8.4.21; < 8.5.6
Patched in
8.3.32; 8.4.21; 8.5.6
mediumCVE-2026-14355Jul 2, 2026
ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD
Affected
< 8.2.32; < 8.3.32; < 8.4.23; < 8.5.8
Patched in
8.2.32; 8.3.32; 8.4.23; 8.5.8
mediumCVE-2026-7262May 7, 2026
NULL pointer dereference in SOAP apache:Map decoder with missing <value>
Affected
< 8.2.31; < 8.3.31; < 8.4.21; < 8.5.6
Patched in
8.2.31; 8.3.31; 8.4.21; 8.5.6
mediumCVE-2026-7261May 7, 2026
SoapServer session-persisted object use-after-free via SOAP header fault
Affected
< 8.2.31; < 8.3.31; < 8.4.21; < 8.5.6
Patched in
8.2.31; 8.3.31; 8.4.21; 8.5.6
lowCVE-2026-7259May 7, 2026
Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()
Affected
< 8.5.6; < 8.4.21; < 8.3.31; < 8.2.31
Patched in
8.5.6; 8.4.21; 8.3.31; 8.2.31
mediumCVE-2026-6735May 7, 2026
XSS within PHP-FPM status endpoint
Affected
< 8.2.31; < 8.3.31; < 8.4.21; < 8.5.6
Patched in
8.2.31; 8.3.31; 8.4.21; 8.5.6
highCVE-2026-6722May 7, 2026
Use-After-Free in SOAP using Apache map with Remote Code Execution
Affected
< 8.2.31; < 8.3.31; < 8.4.21; < 8.5.6
Patched in
8.2.31; 8.3.31; 8.4.21; 8.5.6
mediumCVE-2026-7258May 7, 2026
Out-of-bounds read in urldecode()
Affected
< 8.2.31; < 8.3.31; < 8.4.21; < 8.5.6
Patched in
8.2.31; 8.3.31; 8.4.21; 8.5.6
mediumCVE-2026-6104May 7, 2026
Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding
Affected
< 8.4.21; < 8.5.6
Patched in
8.4.21; 8.5.6
highCVE-2025-14179May 7, 2026
SQL injection in pdo_firebird via NUL bytes in quoted strings
Affected
< 8.2.31; < 8.3.31; < 8.4.21; < 8.5.6
Patched in
8.2.31; 8.3.31; 8.4.21; 8.5.6
lowCVE-2026-7568May 7, 2026
Signed integer overflow in metaphone()
Affected
< 8.2.31; < 8.3.31; < 8.4.21; < 8.5.6
Patched in
8.2.31; 8.3.31; 8.4.21; 8.5.6
highCVE-2026-7263May 7, 2026
DoS attack via DOMNode::C14N()
Affected
< 8.4.21; < 8.5.6
Patched in
8.4.21; 8.5.6
lowGHSA-www2-q4fc-65wfDec 18, 2025
Null byte termination in dns_get_record()
Affected
< 8.1.34; < 8.2.30; < 8.3.29; < 8.4.16; < 8.5.1
Patched in
8.1.34; 8.2.30; 8.3.29; 8.4.16; 8.5.1