p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de php · Page n° 2

Vulnérabilités publiées pour php au cours des 30 derniers jours : 13. Présentes dans le catalogue KEV : 0.

RSS ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 106

  1. CVE-2026-6722

    Critique · CVSS 9.5EPSS 0,89%Correctif disponible

    Use-After-Free in SOAP using Apache map

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP reque

    phpPHP
    • Mettez à jour vers 8.2.31
    • Mettez à jour vers 8.3.31
    • Mettez à jour vers 8.4.21
    • Mettez à jour vers 8.5.6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2026-7259

    Faible · CVSS 2.1EPSS 0,19%Correctif disponible

    Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to  a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().

    phpPHP
    • Mettez à jour vers 8.2.31
    • Mettez à jour vers 8.3.31
    • Mettez à jour vers 8.4.21
    • Mettez à jour vers 8.5.6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  3. CVE-2026-7261

    Moyenne · CVSS 6.3EPSS 0,3%Correctif disponible

    SoapServer session-persisted object use-after-free via SOAP header fault

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.

    phpPHP
    • Mettez à jour vers 8.2.31
    • Mettez à jour vers 8.3.31
    • Mettez à jour vers 8.4.21
    • Mettez à jour vers 8.5.6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  4. CVE-2026-7262

    Faible · CVSS 2.9EPSS 0,78%Correctif disponible

    NULL pointer dereference in SOAP apache:Map decoder with missing <value>

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element.  This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.

    phpPHP
    • Mettez à jour vers 8.2.31
    • Mettez à jour vers 8.3.31
    • Mettez à jour vers 8.4.21
    • Mettez à jour vers 8.5.6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2025-14179

    Élevée · CVSS 7.4EPSS 0,44%Correctif disponible

    SQL injection in pdo_firebird via NUL bytes in quoted strings

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.

    phpPHP
    • Mettez à jour vers 8.2.31
    • Mettez à jour vers 8.3.31
    • Mettez à jour vers 8.4.21
    • Mettez à jour vers 8.5.6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  6. CVE-2026-7568

    Moyenne · CVSS 6.3EPSS 0,46%Correctif disponible

    Signed integer overflow in metaphone()

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow occurs, resulting in undefined behavior. This can lead to an out-of-bounds read, causing a segmentation fault or access to unrelated memory, and may affect the availability of the PHP process.

    phpPHP
    • Mettez à jour vers 8.2.31
    • Mettez à jour vers 8.3.31
    • Mettez à jour vers 8.4.21
    • Mettez à jour vers 8.5.6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  7. CVE-2026-6735

    Élevée · CVSS 7.3EPSS 0,19%Correctif disponible

    XSS within PHP-FPM status endpoint

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.

    phpPHP
    • Mettez à jour vers 8.2.31
    • Mettez à jour vers 8.3.31
    • Mettez à jour vers 8.4.21
    • Mettez à jour vers 8.5.6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  8. CVE-2025-14177

    Moyenne · CVSS 6.3EPSS 0,51%Correctif disponible

    Information Leak of Memory in getimagesize

    In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.

    phpPHP
    • Mettez à jour vers 8.1.34
    • Mettez à jour vers 8.2.30
    • Mettez à jour vers 8.3.29
    • Mettez à jour vers 8.4.16
    • Mettez à jour vers 8.5.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  9. CVE-2025-14178

    Moyenne · CVSS 6.5EPSS 0,46%Correctif disponible

    Heap buffer overflow in array_merge()

    In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.

    phpPHP
    • Mettez à jour vers 8.1.34
    • Mettez à jour vers 8.2.30
    • Mettez à jour vers 8.3.29
    • Mettez à jour vers 8.4.16
    • Mettez à jour vers 8.5.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  10. CVE-2025-14180

    Élevée · CVSS 8.2EPSS 0,7%Correctif disponible

    NULL Pointer Dereference in PDO quoting

    In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.

    phpPHP
    • Mettez à jour vers 8.1.34
    • Mettez à jour vers 8.2.30
    • Mettez à jour vers 8.3.29
    • Mettez à jour vers 8.4.16
    • Mettez à jour vers 8.5.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  11. CVE-2025-1735

    Moyenne · CVSS 5.9EPSS 1%Correctif disponible

    pgsql extension does not check for errors during escaping

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.

    phpPHP
    • Mettez à jour vers 8.1.33
    • Mettez à jour vers 8.2.29
    • Mettez à jour vers 8.3.23
    • Mettez à jour vers 8.4.10
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  12. CVE-2025-1220

    Faible · CVSS 3.7EPSS 0,64%Correctif disponible

    Null byte termination in hostnames

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.

    phpPHP
    • Mettez à jour vers 8.1.33
    • Mettez à jour vers 8.2.29
    • Mettez à jour vers 8.3.23
    • Mettez à jour vers 8.4.10
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  13. CVE-2025-6491

    Moyenne · CVSS 5.9EPSS 0,99%Correctif disponible

    NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.

    phpPHP
    • Mettez à jour vers 8.1.33
    • Mettez à jour vers 8.2.29
    • Mettez à jour vers 8.3.23
    • Mettez à jour vers 8.4.10
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  14. CVE-2024-11235

    Critique · CVSS 9.2EPSS 1,48%Correctif disponible

    Reference counting in php_request_shutdown causes Use-After-Free

    In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??=  operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.

    phpPHP
    • Mettez à jour vers 8.3.19
    • Mettez à jour vers 8.4.5
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  15. CVE-2025-1861

    Moyenne · CVSS 6.3EPSS 0,86%Correctif disponible

    Stream HTTP wrapper truncates redirect location to 1024 bytes

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.

    phpPHP
    • Mettez à jour vers 8.1.32
    • Mettez à jour vers 8.2.28
    • Mettez à jour vers 8.3.19
    • Mettez à jour vers 8.4.5
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  16. CVE-2025-1736

    Moyenne · CVSS 6.3EPSS 0,55%Correctif disponible

    Stream HTTP wrapper header check might omit basic auth header

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.

    phpPHP
    • Mettez à jour vers 8.1.32
    • Mettez à jour vers 8.2.28
    • Mettez à jour vers 8.3.19
    • Mettez à jour vers 8.4.5
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  17. CVE-2025-1734

    Moyenne · CVSS 6.3EPSS 0,5%Correctif disponible

    Streams HTTP wrapper does not fail for headers with invalid name and no colon

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.

    phpPHP
    • Mettez à jour vers 8.1.32
    • Mettez à jour vers 8.2.28
    • Mettez à jour vers 8.3.19
    • Mettez à jour vers 8.4.5
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  18. CVE-2025-1219

    Moyenne · CVSS 6.3EPSS 0,75%Correctif disponible

    libxml streams use wrong content-type header when requesting a redirected resource

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.

    phpPHP
    • Mettez à jour vers 8.1.32
    • Mettez à jour vers 8.2.28
    • Mettez à jour vers 8.3.19
    • Mettez à jour vers 8.4.5
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  19. CVE-2025-1217

    Moyenne · CVSS 6.3EPSS 0,58%Correctif disponible

    Header parser of http stream wrapper does not handle folded headers

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the response and using incorrect headers, MIME types, etc.

    phpPHP
    • Mettez à jour vers 8.1.32
    • Mettez à jour vers 8.2.28
    • Mettez à jour vers 8.3.19
    • Mettez à jour vers 8.4.5
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  20. CVE-2022-31631

    Critique · CVSS 9.1EPSS 2,19%Correctif disponible

    PDO::quote() may return unquoted string

    In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.

    phpPHP
    • Mettez à jour vers 8.0.27
    • Mettez à jour vers 8.1.15
    • Mettez à jour vers 8.2.2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →