Is PHP 8.3.27 affected?

Vulnerabilities affecting 8.3.27

• 9.4
  CVE-2026-6722 Use-After-Free in SOAP using Apache map with Remote Code Execution fixed in 8.3.31
• 9.2
  CVE-2026-109618 RCE via OOM corruption fixed in 8.3.36
• 9.2
  CVE-2026-109619 RCE via stale global state fixed in 8.3.36
• 9.2
  CVE-2025-14179 SQL injection in pdo_firebird via NUL bytes in quoted strings fixed in 8.3.31
• 8.2
  CVE-2026-12184 Failure to setup TLS with a remote server can result in a remote DoS fixed in 8.3.32
• 7.6
  CVE-2026-6735 XSS within PHP-FPM status endpoint fixed in 8.3.31
• 7.5
  CVE-2026-91765 SOAP: Unbounded Recursion in Server-Side cleanup_xml_node fixed in 8.3.35
• 6.9
  CVE-2026-17545 PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS fixed in 8.3.35
• 6.5
  CVE-2026-91768 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes) fixed in 8.3.35
• 6.5
  CVE-2026-91767 Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN fixed in 8.3.35
• 6.5
  CVE-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing fixed in 8.3.35
• 6.5
  CVE-2025-14178 Heap buffer overflow in array_merge() fixed in 8.3.29
• 6.3
  CVE-2026-7262 NULL pointer dereference in SOAP apache:Map decoder with missing <value> fixed in 8.3.31
• 6.3
  CVE-2026-7261 SoapServer session-persisted object use-after-free via SOAP header fault fixed in 8.3.31
• 6.3
  CVE-2026-7258 Out-of-bounds read in urldecode() fixed in 8.3.31
• 6.3
  CVE-2025-14180 NULL Pointer Dereference in PDO quoting fixed in 8.3.29
• 6.3
  CVE-2025-14177 Information Leak of Memory in getimagesize fixed in 8.3.29
• 5.9
  CVE-2026-92842 OOB read / info leak in convert.* stream filters when line-break-chars contains NUL fixed in 8.3.35
• 5.9
  CVE-2026-91766 Cross-origin credential leak in HTTP stream wrapper redirects fixed in 8.3.35
• 5.5
  CVE-2026-7260 Stack overflow in phar with circular symlinks fixed in 8.3.33
• 5.3
  CVE-2026-93682 Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header fixed in 8.3.35
• 4.8
  CVE-2026-14355 ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD fixed in 8.3.32
• 4.3
  CVE-2026-91769 TLS Hostname Verification Falls Back to CN After SAN Mismatch fixed in 8.3.35
• 4.0
  CVE-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection fixed in 8.3.35
• 3.7
  GHSA-ch8v-r6jh-4vvr ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED fixed in 8.3.35
• 3.1
  CVE-2025-1218 Various packet overreads in mysqlnd_writeprotocol.c fixed in 8.3.35
• high
  CVE-2026-17543 SQL injection in ext-pgsql via E'...' backslash breakout fixed in 8.3.33
• low
  CVE-2026-7259 Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() fixed in 8.3.31
• low
  CVE-2026-7568 Signed integer overflow in metaphone() fixed in 8.3.31
• low
  GHSA-www2-q4fc-65wf Null byte termination in dns_get_record() fixed in 8.3.29

Newer releases