PHP 8.3.17 → 8.5.12

55 releases · 0 breaking changes · 109 security fixes · 40 advisories fixed

109security0breaking0deprecated0feature0fix

Is 8.3.17 affected?

Vulnerabilities fixed by this upgrade

9.2 CVE-2026-109618 RCE via OOM corruption
9.2 CVE-2026-109619 RCE via stale global state
5.3 CVE-2026-93682 Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
5.9 CVE-2026-92842 OOB read / info leak in convert.* stream filters when line-break-chars contains NUL
3.7 GHSA-ch8v-r6jh-4vvr ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED
6.5 CVE-2026-91768 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
4.3 CVE-2026-91769 TLS Hostname Verification Falls Back to CN After SAN Mismatch
6.5 CVE-2026-91767 Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN
3.1 CVE-2025-1218 Various packet overreads in mysqlnd_writeprotocol.c
5.9 CVE-2026-91766 Cross-origin credential leak in HTTP stream wrapper redirects
7.5 CVE-2026-91765 SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
6.5 CVE-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing
4.0 CVE-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection
6.9 CVE-2026-17545 PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
5.5 CVE-2026-7260 Stack overflow in phar with circular symlinks
high CVE-2026-17543 SQL injection in ext-pgsql via E'...' backslash breakout
8.2 CVE-2026-12184 Failure to setup TLS with a remote server can result in a remote DoS
4.8 CVE-2026-14355 ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD
6.3 CVE-2026-7262 NULL pointer dereference in SOAP apache:Map decoder with missing <value>
6.3 CVE-2026-7261 SoapServer session-persisted object use-after-free via SOAP header fault
low CVE-2026-7259 Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()
7.6 CVE-2026-6735 XSS within PHP-FPM status endpoint
9.4 CVE-2026-6722 Use-After-Free in SOAP using Apache map with Remote Code Execution
6.3 CVE-2026-7258 Out-of-bounds read in urldecode()
9.2 CVE-2025-14179 SQL injection in pdo_firebird via NUL bytes in quoted strings
low CVE-2026-7568 Signed integer overflow in metaphone()
low GHSA-www2-q4fc-65wf Null byte termination in dns_get_record()
6.3 CVE-2025-14180 NULL Pointer Dereference in PDO quoting
6.5 CVE-2025-14178 Heap buffer overflow in array_merge()
6.3 CVE-2025-14177 Information Leak of Memory in getimagesize
medium CVE-2025-1735 pgsql extension does not check for errors during escaping
5.9 CVE-2025-6491 NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
low CVE-2025-1220 Null byte termination in hostnames
medium CVE-2024-11235 Reference counting in php_request_shutdown causes Use-After-Free
low GHSA-wg4p-4hqh-c3g9 Possible out of bounds read when XML_OPTION_SKIP_TAGSTART used
medium CVE-2025-1219 libxml streams use wrong `content-type` header when requesting a redirected resource
medium CVE-2025-1736 Stream HTTP wrapper header check might omit basic auth header
medium CVE-2025-1861 Stream HTTP wrapper truncate redirect location to 1024 bytes
medium CVE-2025-1734 Streams HTTP wrapper does not fail for headers with invalid name and no colon
medium CVE-2025-1217 Header parser of `http` stream wrapper does not handle folded headers

Breaking changes

None in the release notes.

Security changes

security Fixes CVE-2026-109618: RCE via OOM corruption in 8.5.12
security Fixes CVE-2026-109619: RCE via stale global state in 8.5.12
security Fixes CVE-2026-91765: SOAP: Unbounded Recursion in Server-Side cleanup_xml_node in 8.5.11
security Fixes CVE-2026-17545: PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS in 8.5.11
security Fixes CVE-2026-91768: IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes) in 8.5.11
security Fixes CVE-2026-91767: Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN in 8.5.11
security Fixes CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing in 8.5.11
security Fixes CVE-2026-92842: OOB read / info leak in convert.* stream filters when line-break-chars contains NUL in 8.5.11
security Fixes CVE-2026-91766: Cross-origin credential leak in HTTP stream wrapper redirects in 8.5.11
security Fixes CVE-2026-93682: Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header in 8.5.11
security Fixes CVE-2026-91769: TLS Hostname Verification Falls Back to CN After SAN Mismatch in 8.5.11
security Fixes CVE-2026-6103: Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection in 8.5.11
security Fixes CVE-2025-1218: Various packet overreads in mysqlnd_writeprotocol.c in 8.5.11
security Fixes GHSA-ch8v-r6jh-4vvr: ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED in 8.5.10
security Fixes CVE-2026-7260: Stack overflow in phar with circular symlinks in 8.5.9
security Fixes CVE-2026-17544: Out-of-bounds write in bccomp() via crafted operand and scale in 8.5.9
security Fixes CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout in 8.5.9
security Fixes CVE-2026-14355: ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD in 8.5.8
security Fixes CVE-2026-6722: Use-After-Free in SOAP using Apache map with Remote Code Execution in 8.5.6
security Fixes CVE-2025-14179: SQL injection in pdo_firebird via NUL bytes in quoted strings in 8.5.6
security Fixes CVE-2026-12184: Failure to setup TLS with a remote server can result in a remote DoS in 8.5.6
security Fixes CVE-2026-7263: DoS attack via DOMNode::C14N() in 8.5.6
security Fixes CVE-2026-6735: XSS within PHP-FPM status endpoint in 8.5.6
security Fixes CVE-2026-7262: NULL pointer dereference in SOAP apache:Map decoder with missing <value> in 8.5.6
security Fixes CVE-2026-7261: SoapServer session-persisted object use-after-free via SOAP header fault in 8.5.6
security Fixes CVE-2026-7258: Out-of-bounds read in urldecode() in 8.5.6
security Fixes CVE-2026-6104: Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding in 8.5.6
security Fixes CVE-2026-7259: Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() in 8.5.6
security Fixes CVE-2026-7568: Signed integer overflow in metaphone() in 8.5.6
security Fixes CVE-2025-14178: Heap buffer overflow in array_merge() in 8.5.1
security Fixes CVE-2025-14180: NULL Pointer Dereference in PDO quoting in 8.5.1
security Fixes CVE-2025-14177: Information Leak of Memory in getimagesize in 8.5.1
security Fixes GHSA-www2-q4fc-65wf: Null byte termination in dns_get_record() in 8.5.1
security Fixes CVE-2026-109618: RCE via OOM corruption in 8.4.27
security Fixes CVE-2026-109619: RCE via stale global state in 8.4.27
security Fixes CVE-2026-91765: SOAP: Unbounded Recursion in Server-Side cleanup_xml_node in 8.4.26
security Fixes CVE-2026-17545: PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS in 8.4.26
security Fixes CVE-2026-91768: IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes) in 8.4.26
security Fixes CVE-2026-91767: Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN in 8.4.26
security Fixes CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing in 8.4.26
security Fixes CVE-2026-92842: OOB read / info leak in convert.* stream filters when line-break-chars contains NUL in 8.4.26
security Fixes CVE-2026-91766: Cross-origin credential leak in HTTP stream wrapper redirects in 8.4.26
security Fixes CVE-2026-93682: Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header in 8.4.26
security Fixes CVE-2026-91769: TLS Hostname Verification Falls Back to CN After SAN Mismatch in 8.4.26
security Fixes CVE-2026-6103: Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection in 8.4.26
security Fixes CVE-2025-1218: Various packet overreads in mysqlnd_writeprotocol.c in 8.4.26
security Fixes GHSA-ch8v-r6jh-4vvr: ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED in 8.4.25
security Fixes CVE-2026-7260: Stack overflow in phar with circular symlinks in 8.4.24
security Fixes CVE-2026-17544: Out-of-bounds write in bccomp() via crafted operand and scale in 8.4.24
security Fixes CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout in 8.4.24
security Fixes CVE-2026-14355: ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD in 8.4.23
security Fixes CVE-2026-6722: Use-After-Free in SOAP using Apache map with Remote Code Execution in 8.4.21
security Fixes CVE-2025-14179: SQL injection in pdo_firebird via NUL bytes in quoted strings in 8.4.21
security Fixes CVE-2026-12184: Failure to setup TLS with a remote server can result in a remote DoS in 8.4.21
security Fixes CVE-2026-7263: DoS attack via DOMNode::C14N() in 8.4.21
security Fixes CVE-2026-6735: XSS within PHP-FPM status endpoint in 8.4.21
security Fixes CVE-2026-7262: NULL pointer dereference in SOAP apache:Map decoder with missing <value> in 8.4.21
security Fixes CVE-2026-7261: SoapServer session-persisted object use-after-free via SOAP header fault in 8.4.21
security Fixes CVE-2026-7258: Out-of-bounds read in urldecode() in 8.4.21
security Fixes CVE-2026-6104: Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding in 8.4.21
security Fixes CVE-2026-7259: Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() in 8.4.21
security Fixes CVE-2026-7568: Signed integer overflow in metaphone() in 8.4.21
security Fixes CVE-2025-14178: Heap buffer overflow in array_merge() in 8.4.16
security Fixes CVE-2025-14180: NULL Pointer Dereference in PDO quoting in 8.4.16
security Fixes CVE-2025-14177: Information Leak of Memory in getimagesize in 8.4.16
security Fixes GHSA-www2-q4fc-65wf: Null byte termination in dns_get_record() in 8.4.16
security Fixes CVE-2025-6491: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix in 8.4.10
security Fixes CVE-2025-1735: pgsql extension does not check for errors during escaping in 8.4.10
security Fixes CVE-2025-1220: Null byte termination in hostnames in 8.4.10
security Fixes CVE-2024-11235: Reference counting in php_request_shutdown causes Use-After-Free in 8.4.5
security Fixes GHSA-wg4p-4hqh-c3g9: Possible out of bounds read when XML_OPTION_SKIP_TAGSTART used in 8.4.5
security Fixes CVE-2025-1219: libxml streams use wrong `content-type` header when requesting a redirected resource in 8.4.5
security Fixes CVE-2025-1736: Stream HTTP wrapper header check might omit basic auth header in 8.4.5
security Fixes CVE-2025-1861: Stream HTTP wrapper truncate redirect location to 1024 bytes in 8.4.5
security Fixes CVE-2025-1734: Streams HTTP wrapper does not fail for headers with invalid name and no colon in 8.4.5
security Fixes CVE-2025-1217: Header parser of `http` stream wrapper does not handle folded headers in 8.4.5
security Fixes CVE-2026-109618: RCE via OOM corruption in 8.3.36
security Fixes CVE-2026-109619: RCE via stale global state in 8.3.36
security Fixes CVE-2026-91765: SOAP: Unbounded Recursion in Server-Side cleanup_xml_node in 8.3.35
security Fixes CVE-2026-17545: PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS in 8.3.35
security Fixes CVE-2026-91768: IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes) in 8.3.35
security Fixes CVE-2026-91767: Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN in 8.3.35
security Fixes CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing in 8.3.35
security Fixes CVE-2026-92842: OOB read / info leak in convert.* stream filters when line-break-chars contains NUL in 8.3.35
security Fixes CVE-2026-91766: Cross-origin credential leak in HTTP stream wrapper redirects in 8.3.35
security Fixes CVE-2026-93682: Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header in 8.3.35
security Fixes CVE-2026-91769: TLS Hostname Verification Falls Back to CN After SAN Mismatch in 8.3.35
security Fixes CVE-2026-6103: Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection in 8.3.35
security Fixes GHSA-ch8v-r6jh-4vvr: ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED in 8.3.35
security Fixes CVE-2025-1218: Various packet overreads in mysqlnd_writeprotocol.c in 8.3.35
security Fixes CVE-2026-7260: Stack overflow in phar with circular symlinks in 8.3.33
security Fixes CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout in 8.3.33
security Fixes CVE-2026-12184: Failure to setup TLS with a remote server can result in a remote DoS in 8.3.32
security Fixes CVE-2026-14355: ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD in 8.3.32
security Fixes CVE-2026-6722: Use-After-Free in SOAP using Apache map with Remote Code Execution in 8.3.31
security Fixes CVE-2025-14179: SQL injection in pdo_firebird via NUL bytes in quoted strings in 8.3.31
security Fixes CVE-2026-6735: XSS within PHP-FPM status endpoint in 8.3.31
security Fixes CVE-2026-7262: NULL pointer dereference in SOAP apache:Map decoder with missing <value> in 8.3.31
security Fixes CVE-2026-7261: SoapServer session-persisted object use-after-free via SOAP header fault in 8.3.31
security Fixes CVE-2026-7258: Out-of-bounds read in urldecode() in 8.3.31
security Fixes CVE-2026-7259: Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() in 8.3.31
security Fixes CVE-2026-7568: Signed integer overflow in metaphone() in 8.3.31
security Fixes CVE-2025-14178: Heap buffer overflow in array_merge() in 8.3.29
security Fixes CVE-2025-14180: NULL Pointer Dereference in PDO quoting in 8.3.29
security Fixes CVE-2025-14177: Information Leak of Memory in getimagesize in 8.3.29
security Fixes GHSA-www2-q4fc-65wf: Null byte termination in dns_get_record() in 8.3.29
security Fixes CVE-2025-6491: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix in 8.3.23
security Fixes CVE-2025-1735: pgsql extension does not check for errors during escaping in 8.3.23
security Fixes CVE-2025-1220: Null byte termination in hostnames in 8.3.23

Every release in between

8.5.12 Oct 21, 2026 Release notes ↗

securityFixes CVE-2026-109618: RCE via OOM corruption

securityFixes CVE-2026-109619: RCE via stale global state

8.5.11 Sep 24, 2026 Release notes ↗

securityFixes CVE-2026-91765: SOAP: Unbounded Recursion in Server-Side cleanup_xml_node

securityFixes CVE-2026-17545: PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS

securityFixes CVE-2026-91768: IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

securityFixes CVE-2026-91767: Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN

securityFixes CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing

securityFixes CVE-2026-92842: OOB read / info leak in convert.* stream filters when line-break-chars contains NUL

securityFixes CVE-2026-91766: Cross-origin credential leak in HTTP stream wrapper redirects

securityFixes CVE-2026-93682: Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header

securityFixes CVE-2026-91769: TLS Hostname Verification Falls Back to CN After SAN Mismatch

securityFixes CVE-2026-6103: Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection

securityFixes CVE-2025-1218: Various packet overreads in mysqlnd_writeprotocol.c

8.5.10 Aug 28, 2026 Release notes ↗

securityFixes GHSA-ch8v-r6jh-4vvr: ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED

8.5.9 Jul 30, 2026 Release notes ↗

securityFixes CVE-2026-7260: Stack overflow in phar with circular symlinks

securityFixes CVE-2026-17544: Out-of-bounds write in bccomp() via crafted operand and scale

securityFixes CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout

8.5.8 Jul 3, 2026 Release notes ↗

securityFixes CVE-2026-14355: ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD

8.5.7 Jun 4, 2026 Release notes ↗

8.5.6 May 7, 2026 Release notes ↗

securityFixes CVE-2026-6722: Use-After-Free in SOAP using Apache map with Remote Code Execution

securityFixes CVE-2025-14179: SQL injection in pdo_firebird via NUL bytes in quoted strings

securityFixes CVE-2026-12184: Failure to setup TLS with a remote server can result in a remote DoS

securityFixes CVE-2026-7263: DoS attack via DOMNode::C14N()

securityFixes CVE-2026-6735: XSS within PHP-FPM status endpoint

securityFixes CVE-2026-7262: NULL pointer dereference in SOAP apache:Map decoder with missing <value>

securityFixes CVE-2026-7261: SoapServer session-persisted object use-after-free via SOAP header fault

securityFixes CVE-2026-7258: Out-of-bounds read in urldecode()

securityFixes CVE-2026-6104: Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding

securityFixes CVE-2026-7259: Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()

securityFixes CVE-2026-7568: Signed integer overflow in metaphone()

8.5.5 Apr 9, 2026 Release notes ↗

8.5.4 Mar 12, 2026 Release notes ↗

8.5.3 Feb 12, 2026 Release notes ↗

8.5.2 Feb 6, 2026 Release notes ↗

8.5.1 Dec 18, 2025 Release notes ↗

securityFixes CVE-2025-14178: Heap buffer overflow in array_merge()

securityFixes CVE-2025-14180: NULL Pointer Dereference in PDO quoting

securityFixes CVE-2025-14177: Information Leak of Memory in getimagesize

securityFixes GHSA-www2-q4fc-65wf: Null byte termination in dns_get_record()

8.5.0 Nov 20, 2025 Release notes ↗

8.4.27 Oct 21, 2026 Release notes ↗

securityFixes CVE-2026-109618: RCE via OOM corruption

securityFixes CVE-2026-109619: RCE via stale global state

8.4.26 Sep 24, 2026 Release notes ↗