PHP 8.3.17 → 8.3.25

Vulnerabilities fixed by this upgrade

• medium CVE-2025-1735 pgsql extension does not check for errors during escaping
• 5.9 CVE-2025-6491 NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
• low CVE-2025-1220 Null byte termination in hostnames
• medium CVE-2024-11235 Reference counting in php_request_shutdown causes Use-After-Free
• low GHSA-wg4p-4hqh-c3g9 Possible out of bounds read when XML_OPTION_SKIP_TAGSTART used
• medium CVE-2025-1219 libxml streams use wrong `content-type` header when requesting a redirected resource
• medium CVE-2025-1736 Stream HTTP wrapper header check might omit basic auth header
• medium CVE-2025-1861 Stream HTTP wrapper truncate redirect location to 1024 bytes
• medium CVE-2025-1734 Streams HTTP wrapper does not fail for headers with invalid name and no colon
• medium CVE-2025-1217 Header parser of `http` stream wrapper does not handle folded headers

Breaking changes

None in the release notes.

Security changes

• security Fixes CVE-2025-6491: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix in 8.3.23
• security Fixes CVE-2025-1735: pgsql extension does not check for errors during escaping in 8.3.23
• security Fixes CVE-2025-1220: Null byte termination in hostnames in 8.3.23

Every release in between