PHP 8.4.11 → 8.4.22
11 releases · 0 breaking changes · 15 security fixes · 15 advisories fixed
15security0breaking0deprecated0feature0fix
Vulnerabilities fixed by this upgrade
- 8.2 CVE-2026-12184 Failure to setup TLS with a remote server can result in a remote DoS
- 6.3 CVE-2026-7262 NULL pointer dereference in SOAP apache:Map decoder with missing <value>
- 6.3 CVE-2026-7261 SoapServer session-persisted object use-after-free via SOAP header fault
- low CVE-2026-7259 Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()
- 7.6 CVE-2026-6735 XSS within PHP-FPM status endpoint
- 9.4 CVE-2026-6722 Use-After-Free in SOAP using Apache map with Remote Code Execution
- 6.3 CVE-2026-7258 Out-of-bounds read in urldecode()
- 6.3 CVE-2026-6104 Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding
- 9.2 CVE-2025-14179 SQL injection in pdo_firebird via NUL bytes in quoted strings
- low CVE-2026-7568 Signed integer overflow in metaphone()
- 8.2 CVE-2026-7263 DoS attack via DOMNode::C14N()
- low GHSA-www2-q4fc-65wf Null byte termination in dns_get_record()
- 6.3 CVE-2025-14180 NULL Pointer Dereference in PDO quoting
- 6.5 CVE-2025-14178 Heap buffer overflow in array_merge()
- 6.3 CVE-2025-14177 Information Leak of Memory in getimagesize
Breaking changes
None in the release notes.
Security changes
- security Fixes CVE-2026-6722: Use-After-Free in SOAP using Apache map with Remote Code Execution in 8.4.21
- security Fixes CVE-2025-14179: SQL injection in pdo_firebird via NUL bytes in quoted strings in 8.4.21
- security Fixes CVE-2026-12184: Failure to setup TLS with a remote server can result in a remote DoS in 8.4.21
- security Fixes CVE-2026-7263: DoS attack via DOMNode::C14N() in 8.4.21
- security Fixes CVE-2026-6735: XSS within PHP-FPM status endpoint in 8.4.21
- security Fixes CVE-2026-7262: NULL pointer dereference in SOAP apache:Map decoder with missing <value> in 8.4.21
- security Fixes CVE-2026-7261: SoapServer session-persisted object use-after-free via SOAP header fault in 8.4.21
- security Fixes CVE-2026-7258: Out-of-bounds read in urldecode() in 8.4.21
- security Fixes CVE-2026-6104: Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding in 8.4.21
- security Fixes CVE-2026-7259: Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() in 8.4.21
- security Fixes CVE-2026-7568: Signed integer overflow in metaphone() in 8.4.21
- security Fixes CVE-2025-14178: Heap buffer overflow in array_merge() in 8.4.16
- security Fixes CVE-2025-14180: NULL Pointer Dereference in PDO quoting in 8.4.16
- security Fixes CVE-2025-14177: Information Leak of Memory in getimagesize in 8.4.16
- security Fixes GHSA-www2-q4fc-65wf: Null byte termination in dns_get_record() in 8.4.16
Every release in between
securityFixes CVE-2026-6722: Use-After-Free in SOAP using Apache map with Remote Code Execution
securityFixes CVE-2025-14179: SQL injection in pdo_firebird via NUL bytes in quoted strings
securityFixes CVE-2026-12184: Failure to setup TLS with a remote server can result in a remote DoS
securityFixes CVE-2026-7263: DoS attack via DOMNode::C14N()
securityFixes CVE-2026-6735: XSS within PHP-FPM status endpoint
securityFixes CVE-2026-7262: NULL pointer dereference in SOAP apache:Map decoder with missing <value>
securityFixes CVE-2026-7261: SoapServer session-persisted object use-after-free via SOAP header fault
securityFixes CVE-2026-7258: Out-of-bounds read in urldecode()
securityFixes CVE-2026-6104: Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding
securityFixes CVE-2026-7259: Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()
securityFixes CVE-2026-7568: Signed integer overflow in metaphone()
securityFixes CVE-2025-14178: Heap buffer overflow in array_merge()
securityFixes CVE-2025-14180: NULL Pointer Dereference in PDO quoting
securityFixes CVE-2025-14177: Information Leak of Memory in getimagesize
securityFixes GHSA-www2-q4fc-65wf: Null byte termination in dns_get_record()