Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2025-1218: The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still hold

24
Routine
LOW 3.4WATCHLISTUPGRADE

CVE-2025-1218 is a low-severity flaw (CVSS 3.4) affecting php. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.

Why this priority

  • Public exploit reference
  • On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score3.4 (Low)
Attack vectorAdjacent network
Attack complexityHigh
Privileges neededNone
User interactionNone
EPSS exploit chance0.2% (top 93%)
CISA exploited listNo
WeaknessCWE-122
Published2026-09-25
Last modified2026-10-23
Publisher (CNA): PHP Group · Vendor: php

Am I affected?

Timeline

php php UPGRADE
Affected: >= 8.2.0 and < 8.2.34 · >= 8.3.0 and < 8.3.35 · >= 8.4.0 and < 8.4.26 · >= 8.5.0 and < 8.5.11
Fixed in: 8.2.34, 8.3.35, 8.4.26, 8.5.11
Safe to downgrade to: a release before 8.2.0
1. Check installed version
apt-cache policy php || rpm -q php || php --version
2. UPGRADE to 8.2.34 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade php
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade php
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 8.2.0 (Debian / Ubuntu)
apt-cache madison php sudo apt install php=<VERSION_BEFORE_8.2.0> sudo apt-mark hold php
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list php sudo dnf downgrade php-<VERSION_BEFORE_8.2.0> sudo dnf versionlock add php
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

Ubuntu 20.04 · php7.4 · FIXED · 7.4.3-4ubuntu2.29+esm4
sudo apt update && sudo apt install --only-upgrade php7.4 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php7.4)" ge "7.4.3-4ubuntu2.29+esm4" && echo PATCHED || echo STILL-VULNERABLE
Ubuntu 22.04 · php8.1 · FIXED · 8.1.2-1ubuntu2.27
sudo apt update && sudo apt install --only-upgrade php8.1 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php8.1)" ge "8.1.2-1ubuntu2.27" && echo PATCHED || echo STILL-VULNERABLE
Ubuntu 24.04 · php8.3 · FIXED · 8.3.6-0ubuntu0.24.04.12
sudo apt update && sudo apt install --only-upgrade php8.3 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php8.3)" ge "8.3.6-0ubuntu0.24.04.12" && echo PATCHED || echo STILL-VULNERABLE
Debian 12 · php8.2 · FIXED · 8.2.34-1~deb12u1
sudo apt update && sudo apt install --only-upgrade php8.2 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php8.2)" ge "8.2.34-1~deb12u1" && echo PATCHED || echo STILL-VULNERABLE
Debian 13 · php8.4 · FIXED · 8.4.26-1~deb13u1
sudo apt update && sudo apt install --only-upgrade php8.4 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php8.4)" ge "8.4.26-1~deb13u1" && echo PATCHED || echo STILL-VULNERABLE
RHEL 10 · php · DEFERRED
RHEL 10 · php8.4 · DEFERRED
RHEL 6 · php · DEFERRED
RHEL 7 · php · DEFERRED
RHEL 8 · php:8.2/php · DEFERRED
Alpine 3.22 · php82 · FIXED · php82-8.2.35-r0
apk add --upgrade php82 apk info -v php82
Alpine 3.22 · php83 · FIXED · php83-8.3.36-r0
apk add --upgrade php83 apk info -v php83
Alpine 3.22 · php84 · FIXED · php84-8.4.27-r0
apk add --upgrade php84 apk info -v php84
Alpine 3.23 · php83 · FIXED · php83-8.3.36-r0
apk add --upgrade php83 apk info -v php83
Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2026-3164 · source
sudo dnf update --advisory=ALAS2023-2026-3164

Advisories and coverage

Official advisories

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-1218?

php: upgrade to 8.2.34, 8.3.35, 8.4.26, 8.5.11. Exact commands for each OS are on this page.

Is CVE-2025-1218 being exploited?

CVE-2025-1218 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2025-1218 affect?

CVE-2025-1218 affects php. Severity is low (CVSS 3.4). The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end

How urgent is CVE-2025-1218?

Priority 24/100. Public exploit reference; On your watchlist

Related CVEs

References

← Back to latest CVEs