Cross-origin credential leak in HTTP stream wrapper redirects

Fixed (Heap buffer overflow in phpopensslmatcheswildcardname() on crafted server certificate wildcard CN). (CVE-2026-91767)

Fixed (IPv6 ACL bypass in FastCGI listen.allowedclients due to partial address comparison). (CVE-2026-91768)

Fixed (Out-of-bounds read in convert. stream filters when line-break-chars contains NUL). (CVE-2026-92842)

Fixed (Integer overflow in phartarnumber() allowing TAR archive entry injection). (CVE-2026-6103)

Fixed (TLS hostname verification falls back to CN after SAN mismatch). (CVE-2026-91769)

Fixed (Integer overflow to buffer overflow in SOAP HTTP parsing). (CVE-2025-14181)

Fixed (Reserved device names are not rejected before file and stream I/O). (CVE-2026-17545)

Fixed (Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header). (CVE-2026-93682)

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9.

ext/openssl: Memory corruption in opensslencrypt with AES-WRAP-PAD

Simple Fields 0.2 through 0.3.5 WordPress Plugin contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by injecting null bytes into the wpabspath parameter on PHP versions before 5.3.4. Attackers can supply malicious wpabspath values to simplefields.php to include files like /etc/passwd or inject PHP code into Apache logs for remote code execution when allowurlinclude is enabled.

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, 8.5. before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mbregexencoding().

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, when SoapServer is configured with SOAPPERSISTENCESESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.

Fixed CVE-2026-44928 (In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal). (CVE-2026-44928)

Fixed CVE-2026-44927 (In uriparser before 1.0.2, there is pointer difference truncation to int in various places). (CVE-2026-44927)

Fixed (Use-after-free after header parsing failure with SOAPPERSISTENCESESSION). (CVE-2026-7261)

Fixed (Consistently pass unsigned char to ctype.h functions). (CVE-2026-7258)

Fixed (Signed integer overflow of char array offset). (CVE-2026-7568)

Fixed and (Dom\XMLDocument::C14N() emits duplicate xmlns declarations after setAttributeNS()). (CVE-2026-7263)

Fixed (Out-of-bounds access in mbflname2encodingex()). (CVE-2026-6104)

Fixed CVE-2026-42371 (uriparser before 1.0.1 has numeric truncation in text range comparison). (CVE-2026-42371)

In PHP versions:8.1. before 8.1.34, 8.2. before 8.2.30, 8.3. before 8.3.29, 8.4. before 8.4.16, 8.5. before 8.5.1, a heap buffer overflow occurs in arraymerge() when the total element count of packed arrays exceeds 32-bit limits or HTMAXSIZE, due to an integer overflow in the precomputation of element counts using zendhashnumelements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.

Fixed (Information Leak of Memory in getimagesize). (CVE-2025-14177)

ImpactThis is an information disclosure vulnerability originating from PHP's base image. This vulnerability exposes the PHP version through an X-Powered-By header, which attackers could exploit to fingerprint the server and identify potential weaknesses.

WorkaroundsThe mitigation requires changing the exposephp variable from "On" to "Off" in the file located at /usr/local/etc/php/php.ini.

Fixed (Null byte termination in hostnames). (CVE-2025-1220)

Fixed (NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix). (CVE-2025-6491)

In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.