p PatchFirst

PatchFirst · Latest vulnerabilities

php8.2 vulnerabilities · Page 2

Vulnerabilities published for php8.2 in the last 30 days: 12. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 63

  1. CVE-2026-7262

    Low · CVSS 2.9EPSS 0.78%Fix available

    NULL pointer dereference in SOAP apache:Map decoder with missing <value>

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element.  This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.

    php8.2Operating systems
    • Update to 8.2.31-1~deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2025-14179

    High · CVSS 7.4EPSS 0.44%Fix available

    SQL injection in pdo_firebird via NUL bytes in quoted strings

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.

    php8.2Operating systems
    • Update to 8.2.31-1~deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2026-7568

    Medium · CVSS 6.3EPSS 0.46%Fix available

    Signed integer overflow in metaphone()

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow occurs, resulting in undefined behavior. This can lead to an out-of-bounds read, causing a segmentation fault or access to unrelated memory, and may affect the availability of the PHP process.

    php8.2Operating systems
    • Update to 8.2.31-1~deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2026-6735

    High · CVSS 7.3EPSS 0.19%Fix available

    XSS within PHP-FPM status endpoint

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.

    php8.2Operating systems
    • Update to 8.2.31-1~deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  6. CVE-2025-14177

    Medium · CVSS 6.3EPSS 0.51%Fix available

    Information Leak of Memory in getimagesize

    In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.

    php8.2Operating systems
    • Update to 8.2.30-1~deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  7. CVE-2025-14178

    Medium · CVSS 6.5EPSS 0.46%Fix available

    Heap buffer overflow in array_merge()

    In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.

    php8.2Operating systems
    • Update to 8.2.30-1~deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. CVE-2025-14180

    High · CVSS 8.2EPSS 0.7%Fix available

    NULL Pointer Dereference in PDO quoting

    In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.

    php8.2Operating systems
    • Update to 8.2.30-1~deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  10. CVE-2025-1735

    Medium · CVSS 5.9EPSS 1%Fix available

    pgsql extension does not check for errors during escaping

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.

    php8.2Operating systems
    • Update to 8.2.29-1~deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. CVE-2025-1220

    Low · CVSS 3.7EPSS 0.64%Fix available

    Null byte termination in hostnames

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.

    php8.2Operating systems
    • Update to 8.2.29-1~deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. CVE-2025-6491

    Medium · CVSS 5.9EPSS 0.99%Fix available

    NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.

    php8.2Operating systems
    • Update to 8.2.29-1~deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. CVE-2025-1861

    Medium · CVSS 6.3EPSS 0.86%Fix available

    Stream HTTP wrapper truncates redirect location to 1024 bytes

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.

    php8.2Operating systems
    • Update to 8.2.28-1~deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. CVE-2025-1736

    Medium · CVSS 6.3EPSS 0.55%Fix available

    Stream HTTP wrapper header check might omit basic auth header

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.

    php8.2Operating systems
    • Update to 8.2.28-1~deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. CVE-2025-1734

    Medium · CVSS 6.3EPSS 0.5%Fix available

    Streams HTTP wrapper does not fail for headers with invalid name and no colon

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.

    php8.2Operating systems
    • Update to 8.2.28-1~deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. CVE-2025-1219

    Medium · CVSS 6.3EPSS 0.75%Fix available

    libxml streams use wrong content-type header when requesting a redirected resource

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.

    php8.2Operating systems
    • Update to 8.2.28-1~deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. CVE-2025-1217

    Medium · CVSS 6.3EPSS 0.58%Fix available

    Header parser of http stream wrapper does not handle folded headers

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the response and using incorrect headers, MIME types, etc.

    php8.2Operating systems
    • Update to 8.2.28-1~deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. CVE-2022-31631

    Critical · CVSS 9.1EPSS 2.19%Fix available

    PDO::quote() may return unquoted string

    In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.

    php8.2Operating systems
    • Update to 8.2.1-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →