PHP security
PHP security advisories.
Vulnerabilities published for PHP itself, with the release that fixes each one on every supported branch. From the php-src security advisories on GitHub, checked 22 Oct 2026.
Fixes ship only for 8.5, 8.4, 8.3, 8.2. The latest security releases are 8.5.12, 8.4.27, 8.3.36, 8.2.35 (21 Oct 2026). Supported versions →
4 critical · 13 high · 36 medium · 13 low
Each project publishes its own advisories. Their guides link the official sources. Frameworks →
Lessons run PHP 8.5.10 as WebAssembly inside your browser.13 advisories were fixed in later PHP 8.5 releases; the browser build follows when its WebAssembly package is updated.
- critical
CVE-2026-109618Published 21 Oct 2026RCE via OOM corruption
Fixed in
8.2.358.3.368.4.278.5.12 - critical
CVE-2026-109619Published 21 Oct 2026RCE via stale global state
Fixed in
8.2.358.3.368.4.278.5.12 - medium
CVE-2026-93682Published 24 Sept 2026Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
Fixed in
8.2.348.3.358.4.268.5.11 - medium
CVE-2026-92842Published 24 Sept 2026OOB read / info leak in convert.* stream filters when line-break-chars contains NUL
Fixed in
8.2.348.3.358.4.268.5.11 - lowPublished 24 Sept 2026
ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED
Fixed in
8.2.348.3.358.4.258.5.10 - medium
CVE-2026-91768Published 24 Sept 2026IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
Fixed in
8.2.348.3.358.4.268.5.11 - medium
CVE-2026-91769Published 24 Sept 2026TLS Hostname Verification Falls Back to CN After SAN Mismatch
Fixed in
8.2.348.3.358.4.268.5.11 - medium
CVE-2026-91767Published 24 Sept 2026Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN
Fixed in
8.2.348.3.358.4.268.5.11 - low
CVE-2025-1218Published 24 Sept 2026Various packet overreads in mysqlnd_writeprotocol.c
Fixed in
8.2.348.3.358.4.268.5.11 - medium
CVE-2026-91766Published 24 Sept 2026Cross-origin credential leak in HTTP stream wrapper redirects
Fixed in
8.2.348.3.358.4.268.5.11 - high
CVE-2026-91765Published 24 Sept 2026SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
Fixed in
8.2.348.3.358.4.268.5.11 - medium
CVE-2025-14181Published 24 Sept 2026Integer overflow to buffer overflow in soap HTTP parsing
Fixed in
8.2.348.3.358.4.268.5.11 - medium
CVE-2026-6103Published 24 Sept 2026Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection
Fixed in
8.2.348.3.358.4.268.5.11 - medium
CVE-2026-17545Published 24 Sept 2026PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
Fixed in
8.2.348.3.358.4.268.5.11 - medium
CVE-2026-7260Published 30 Jul 2026Stack overflow in phar with circular symlinks
Fixed in
8.2.338.3.338.4.248.5.9 - high
CVE-2026-17544Published 30 Jul 2026Out-of-bounds write in bccomp() via crafted operand and scale
Fixed in
8.4.248.5.9 - high
CVE-2026-17543Published 30 Jul 2026SQL injection in ext-pgsql via E'...' backslash breakout
Fixed in
8.2.338.3.338.4.248.5.9 - high
CVE-2026-12184Published 2 Jul 2026Failure to setup TLS with a remote server can result in a remote DoS
Fixed in
8.3.328.4.218.5.6 - medium
CVE-2026-14355Published 2 Jul 2026ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD
Fixed in
8.2.328.3.328.4.238.5.8 - medium
CVE-2026-7262Published 7 May 2026NULL pointer dereference in SOAP apache:Map decoder with missing <value>
Fixed in
8.2.318.3.318.4.218.5.6 - medium
CVE-2026-7261Published 7 May 2026SoapServer session-persisted object use-after-free via SOAP header fault
Fixed in
8.2.318.3.318.4.218.5.6 - low
CVE-2026-7259Published 7 May 2026Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()
Fixed in
8.2.318.3.318.4.218.5.6 - medium
CVE-2026-6735Published 7 May 2026XSS within PHP-FPM status endpoint
Fixed in
8.2.318.3.318.4.218.5.6 - high
CVE-2026-6722Published 7 May 2026Use-After-Free in SOAP using Apache map with Remote Code Execution
Fixed in
8.2.318.3.318.4.218.5.6 - medium
CVE-2026-7258Published 7 May 2026Out-of-bounds read in urldecode()
Fixed in
8.2.318.3.318.4.218.5.6 - medium
CVE-2026-6104Published 7 May 2026Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding
Fixed in
8.4.218.5.6 - high
CVE-2025-14179Published 7 May 2026SQL injection in pdo_firebird via NUL bytes in quoted strings
Fixed in
8.2.318.3.318.4.218.5.6 - low
CVE-2026-7568Published 7 May 2026Signed integer overflow in metaphone()
Fixed in
8.2.318.3.318.4.218.5.6 - high
CVE-2026-7263Published 7 May 2026DoS attack via DOMNode::C14N()
Fixed in
8.4.218.5.6 - lowPublished 18 Dec 2025
Null byte termination in dns_get_record()
Fixed in
8.1.348.2.308.3.298.4.168.5.1 - medium
CVE-2025-14180Published 18 Dec 2025NULL Pointer Dereference in PDO quoting
Fixed in
8.1.348.2.308.3.298.4.168.5.1 - medium
CVE-2025-14178Published 18 Dec 2025Heap buffer overflow in array_merge()
Fixed in
8.1.348.2.308.3.298.4.168.5.1 - medium
CVE-2025-14177Published 18 Dec 2025Information Leak of Memory in getimagesize
Fixed in
8.1.348.2.308.3.298.4.168.5.1 - medium
CVE-2025-1735Published 3 Jul 2025pgsql extension does not check for errors during escaping
Fixed in
8.1.338.2.298.3.238.4.10 - medium
CVE-2025-6491Published 3 Jul 2025NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
Fixed in
8.1.338.2.298.3.238.4.10 - low
CVE-2025-1220Published 3 Jul 2025Null byte termination in hostnames
Fixed in
8.1.338.2.298.3.238.4.10 - medium
CVE-2024-11235Published 13 Mar 2025Reference counting in php_request_shutdown causes Use-After-Free
Fixed in
8.3.198.4.5 - lowPublished 13 Mar 2025
Possible out of bounds read when XML_OPTION_SKIP_TAGSTART used
Fixed in
8.1.328.2.288.3.198.4.5 - medium
CVE-2025-1219Published 13 Mar 2025libxml streams use wrong `content-type` header when requesting a redirected resource
Fixed in
8.1.328.2.288.3.198.4.5 - medium
CVE-2025-1736Published 13 Mar 2025Stream HTTP wrapper header check might omit basic auth header
Fixed in
8.1.328.2.288.3.198.4.5 - medium
CVE-2025-1861Published 13 Mar 2025Stream HTTP wrapper truncate redirect location to 1024 bytes
Fixed in
8.1.328.2.288.3.198.4.5 - medium
CVE-2025-1734Published 13 Mar 2025Streams HTTP wrapper does not fail for headers with invalid name and no colon
Fixed in
8.1.328.2.288.3.198.4.5 - medium
CVE-2025-1217Published 13 Mar 2025Header parser of `http` stream wrapper does not handle folded headers
Fixed in
8.1.328.2.288.3.198.4.5 - high
CVE-2024-8929Published 21 Nov 2024[Mysqlnd] Leak partial content of the heap through heap buffer over-read
Fixed in
8.1.318.2.268.3.14 - medium
CVE-2024-8932Published 21 Nov 2024OOB access in ldap_escape
Fixed in
8.1.318.2.268.3.14 - medium
CVE-2024-11234Published 21 Nov 2024Configuring a proxy in a stream context might allow for CRLF injection in URIs
Fixed in
8.1.318.2.268.3.14 - medium
CVE-2024-11236Published 21 Nov 2024Integer overflow in the firebird and dblib quoters causing OOB writes
Fixed in
8.1.318.2.268.3.14 - medium
CVE-2024-11233Published 21 Nov 2024Single byte overread with convert.quoted-printable-decode filter
Fixed in
8.1.318.2.268.3.14 - lowPublished 21 Nov 2024
Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface
Fixed in
8.1.318.2.268.3.14 - high
CVE-2024-4577Published 28 Sept 2024PHP RCE: A Bypass of CVE-2012-1823, Argument Injection in PHP-CGI
Fixed in
8.1.298.2.208.3.8 - medium
CVE-2024-8927Published 27 Sept 2024cgi.force_redirect configuration is bypassable due to the environment variable collision
Fixed in
8.1.308.2.248.3.12 - medium
CVE-2024-8926Published 27 Sept 2024PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)
Fixed in
8.1.308.2.248.3.12 - low
CVE-2024-8925Published 27 Sept 2024Erroneous parsing of multipart form data
Fixed in
8.1.308.2.248.3.12 - low
CVE-2024-9026Published 27 Sept 2024[PHP-FPM] Logs from childrens may be altered
Fixed in
8.1.308.2.248.3.12 - high
CVE-2024-5585Published 9 Jun 2024bypass CVE-2024-1874
Fixed in
8.1.298.2.208.3.8 - medium
CVE-2024-5458Published 9 Jun 2024Filter bypass in filter_var (FILTER_VALIDATE_URL)
Fixed in
8.1.298.2.208.3.8 - medium
CVE-2024-2408Published 6 Jun 2024PHP is vulnerable to the Marvin Attack
No fixed version listed in the advisory.
- high
CVE-2024-2757Published 11 Apr 2024mb_encode_mimeheader runs endlessly for some inputs
Fixed in
8.3.6 - low
CVE-2024-3096Published 11 Apr 2024password_verify can erroneously return true, opening ATO risk
Fixed in
8.1.288.2.188.3.6 - critical
CVE-2024-1874Published 11 Apr 2024Command injection via array-ish $command parameter of proc_open even if bypass_shell option enabled on Windows
Fixed in
8.1.288.2.188.3.6 - medium
CVE-2024-2756Published 11 Apr 2024__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
Fixed in
8.1.288.2.188.3.6 - critical
CVE-2023-3824Published 5 Aug 2023Buffer overflow and overread in phar_dir_read()
Fixed in
8.0.30 - high
CVE-2023-3823Published 5 Aug 2023Security issue with external entity loading in XML without enabling it
Fixed in
8.0.30 - low
CVE-2023-3247Published 12 Jun 2023Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
Fixed in
8.0.298.1.208.2.7 - low
CVE-2023-0567Published 15 Feb 2023BCrypt hashes erroneously validate if the salt is cut short by `$`
Fixed in
8.0.288.1.168.2.3 - high
CVE-2023-0662Published 15 Feb 2023DoS vulnerability when parsing multipart request body
Fixed in
8.0.288.1.168.2.3
Source: php-src security advisories. Severity and affected versions are as published by the PHP project; this page adds no assessment of its own.