Fixed bug : buffer overflow in hashupdate() on long parameter. (CVE-2022-37454)

Fixed CVE-2025-67899 (uriparser through 0.9.9 allows unbounded recursion and stack consumption).

Fixed (Various packet overreads in mysqlnd wire protocol). (CVE-2025-1218)

Fixed (Integer overflow to buffer overflow in SOAP HTTP parsing). (CVE-2025-14181)

Fixed (PDO quoting result null deref). (CVE-2025-14180)

Fixed (Information Leak of Memory in getimagesize). (CVE-2025-14177)

Fixed (Heap buffer overflow in arraymerge()). (CVE-2025-14178)

Fixed (IPv6 ACL bypass in FastCGI listen.allowedclients due to partial address comparison). (CVE-2026-91768)

Fixed (Reserved device names are not rejected before file and stream I/O). (CVE-2026-17545)

Fixed (Heap buffer overflow in phpopensslmatcheswildcardname() on crafted server certificate wildcard CN). (CVE-2026-91767)

cleanupxmlnode() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

Cross-origin credential leak in HTTP stream wrapper redirects

Fixed (Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header). (CVE-2026-93682)

Fixed (TLS hostname verification falls back to CN after SAN mismatch). (CVE-2026-91769)

Fixed (Integer overflow in phartarnumber() allowing TAR archive entry injection). (CVE-2026-6103)

Fixed (Out-of-bounds read in convert. stream filters when line-break-chars contains NUL). (CVE-2026-92842)

The errorlog function in basicfunctions.c in PHP before 4.4.4 and 5.x before 5.1.5 allows local users to bypass safe mode and openbasedir restrictions via a "php://" or other scheme in the third argument, which disables safe mode.

PHP 3 and 4 do not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands by triggering error messages that are improperly written to the error logs.

Fixed (SQL injection via E'...' backslash breakout). (CVE-2026-17543)

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9.

ext/openssl: Memory corruption in opensslencrypt with AES-WRAP-PAD

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9.

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9.

Fixed bug (Use-after-free in exif parsing under memory sanitizer). (CVE-2019-11050)

Fixed bug (Buffer underflow in bcshiftaddsub). (CVE-2019-11046)

A vulnerability was found in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

Reference: https://bugs.php.net/bug.php?id=78863

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

Fixed bug (mail() may release string with refcount==1 twice). (CVE-2019-11049)