PHP 8.4.22 → 8.4.26

4 releases · 0 breaking changes · 16 security fixes · 16 advisories fixed

16security0breaking0deprecated0feature0fix

Is 8.4.22 affected? · What changed up to 8.5.12

Vulnerabilities fixed by this upgrade

5.3 CVE-2026-93682 Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
5.9 CVE-2026-92842 OOB read / info leak in convert.* stream filters when line-break-chars contains NUL
3.7 GHSA-ch8v-r6jh-4vvr ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED
6.5 CVE-2026-91768 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
4.3 CVE-2026-91769 TLS Hostname Verification Falls Back to CN After SAN Mismatch
6.5 CVE-2026-91767 Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN
3.1 CVE-2025-1218 Various packet overreads in mysqlnd_writeprotocol.c
5.9 CVE-2026-91766 Cross-origin credential leak in HTTP stream wrapper redirects
7.5 CVE-2026-91765 SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
6.5 CVE-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing
4.0 CVE-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection
6.9 CVE-2026-17545 PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
5.5 CVE-2026-7260 Stack overflow in phar with circular symlinks
high CVE-2026-17544 Out-of-bounds write in bccomp() via crafted operand and scale
high CVE-2026-17543 SQL injection in ext-pgsql via E'...' backslash breakout
4.8 CVE-2026-14355 ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD

Breaking changes

None in the release notes.

Security changes

security Fixes CVE-2026-91765: SOAP: Unbounded Recursion in Server-Side cleanup_xml_node in 8.4.26
security Fixes CVE-2026-17545: PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS in 8.4.26
security Fixes CVE-2026-91768: IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes) in 8.4.26
security Fixes CVE-2026-91767: Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN in 8.4.26
security Fixes CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing in 8.4.26
security Fixes CVE-2026-92842: OOB read / info leak in convert.* stream filters when line-break-chars contains NUL in 8.4.26
security Fixes CVE-2026-91766: Cross-origin credential leak in HTTP stream wrapper redirects in 8.4.26
security Fixes CVE-2026-93682: Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header in 8.4.26
security Fixes CVE-2026-91769: TLS Hostname Verification Falls Back to CN After SAN Mismatch in 8.4.26
security Fixes CVE-2026-6103: Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection in 8.4.26
security Fixes CVE-2025-1218: Various packet overreads in mysqlnd_writeprotocol.c in 8.4.26
security Fixes GHSA-ch8v-r6jh-4vvr: ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED in 8.4.25
security Fixes CVE-2026-7260: Stack overflow in phar with circular symlinks in 8.4.24
security Fixes CVE-2026-17544: Out-of-bounds write in bccomp() via crafted operand and scale in 8.4.24
security Fixes CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout in 8.4.24
security Fixes CVE-2026-14355: ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD in 8.4.23

Every release in between

8.4.26 Sep 24, 2026 Release notes ↗

securityFixes CVE-2026-91765: SOAP: Unbounded Recursion in Server-Side cleanup_xml_node

securityFixes CVE-2026-17545: PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS

securityFixes CVE-2026-91768: IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

securityFixes CVE-2026-91767: Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN

securityFixes CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing

securityFixes CVE-2026-92842: OOB read / info leak in convert.* stream filters when line-break-chars contains NUL

securityFixes CVE-2026-91766: Cross-origin credential leak in HTTP stream wrapper redirects

securityFixes CVE-2026-93682: Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header

securityFixes CVE-2026-91769: TLS Hostname Verification Falls Back to CN After SAN Mismatch

securityFixes CVE-2026-6103: Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection

securityFixes CVE-2025-1218: Various packet overreads in mysqlnd_writeprotocol.c

8.4.25 Aug 28, 2026 Release notes ↗

securityFixes GHSA-ch8v-r6jh-4vvr: ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED

8.4.24 Jul 30, 2026 Release notes ↗

securityFixes CVE-2026-7260: Stack overflow in phar with circular symlinks

securityFixes CVE-2026-17544: Out-of-bounds write in bccomp() via crafted operand and scale

securityFixes CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout

8.4.23 Jul 3, 2026 Release notes ↗

securityFixes CVE-2026-14355: ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD