Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-6103: phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check

21
Routine
MEDIUM 4.3UPGRADE

CVE-2026-6103 is a medium-severity flaw (CVSS 4.3) affecting php. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine.

Why this priority

  • Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score4.3 (Medium)
Attack vectorLocal
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance0.2% (top 94%)
CISA exploited listNo
WeaknessCWE-190
Published2026-09-25
Last modified2026-10-23
Publisher (CNA): PHP Group · Vendor: php

Am I affected?

Timeline

php php UPGRADE
Affected: >= 8.2.0 and < 8.2.34 · >= 8.3.0 and < 8.3.35 · >= 8.4.0 and < 8.4.26 · >= 8.5.0 and < 8.5.11
Fixed in: 8.2.34, 8.3.35, 8.4.26, 8.5.11
Safe to downgrade to: a release before 8.2.0
1. Check installed version
apt-cache policy php || rpm -q php || php --version
2. UPGRADE to 8.2.34 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade php
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade php
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 8.2.0 (Debian / Ubuntu)
apt-cache madison php sudo apt install php=<VERSION_BEFORE_8.2.0> sudo apt-mark hold php
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list php sudo dnf downgrade php-<VERSION_BEFORE_8.2.0> sudo dnf versionlock add php
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.

Advisories and coverage

Official advisories

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Related CVEs

References

← Back to latest CVEs