PatchTheCVECVEs published by PHP Group
CVEs published by PHP Group (CVE Numbering Authority). 13 tracked.
- CVE-2026-17544 CRITICAL 9.8 UPGRADE Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PH
- CVE-2026-17543 CRITICAL 9.8 UPGRADE Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP
- CVE-2026-7260 MEDIUM 5.5 UPGRADE Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashin
- CVE-2026-109618 CRITICAL 9.8 UPGRADE MITIGATE PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the reques
- CVE-2026-109619 HIGH 8.1 UPGRADE MITIGATE PHP has various global state that temporarily points into request memory
- CVE-2026-93682 MEDIUM 5.8 UPGRADE When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value
- CVE-2025-14181 MEDIUM 6.5 UPGRADE The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, wh
- CVE-2025-1218 LOW 3.4 UPGRADE The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still hold
- CVE-2026-17545 HIGH 7.5 UPGRADE On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, C
- CVE-2026-6103 MEDIUM 4.3 UPGRADE phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check
- CVE-2026-91765 HIGH 7.5 UPGRADE cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit
- CVE-2026-91766 MEDIUM 5.9 UPGRADE When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Pro
- CVE-2026-91769 MEDIUM 4.3 UPGRADE PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no