Is PHP 8.4.18 affected?

Vulnerabilities affecting 8.4.18

• 9.4
  CVE-2026-6722 Use-After-Free in SOAP using Apache map with Remote Code Execution fixed in 8.4.21
• 9.2
  CVE-2026-109618 RCE via OOM corruption fixed in 8.4.27
• 9.2
  CVE-2026-109619 RCE via stale global state fixed in 8.4.27
• 9.2
  CVE-2025-14179 SQL injection in pdo_firebird via NUL bytes in quoted strings fixed in 8.4.21
• 8.2
  CVE-2026-12184 Failure to setup TLS with a remote server can result in a remote DoS fixed in 8.4.21
• 8.2
  CVE-2026-7263 DoS attack via DOMNode::C14N() fixed in 8.4.21
• 7.6
  CVE-2026-6735 XSS within PHP-FPM status endpoint fixed in 8.4.21
• 7.5
  CVE-2026-91765 SOAP: Unbounded Recursion in Server-Side cleanup_xml_node fixed in 8.4.26
• 6.9
  CVE-2026-17545 PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS fixed in 8.4.26
• 6.5
  CVE-2026-91768 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes) fixed in 8.4.26
• 6.5
  CVE-2026-91767 Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN fixed in 8.4.26
• 6.5
  CVE-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing fixed in 8.4.26
• 6.3
  CVE-2026-7262 NULL pointer dereference in SOAP apache:Map decoder with missing <value> fixed in 8.4.21
• 6.3
  CVE-2026-7261 SoapServer session-persisted object use-after-free via SOAP header fault fixed in 8.4.21
• 6.3
  CVE-2026-7258 Out-of-bounds read in urldecode() fixed in 8.4.21
• 6.3
  CVE-2026-6104 Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding fixed in 8.4.21
• 5.9
  CVE-2026-92842 OOB read / info leak in convert.* stream filters when line-break-chars contains NUL fixed in 8.4.26
• 5.9
  CVE-2026-91766 Cross-origin credential leak in HTTP stream wrapper redirects fixed in 8.4.26
• 5.5
  CVE-2026-7260 Stack overflow in phar with circular symlinks fixed in 8.4.24
• 5.3
  CVE-2026-93682 Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header fixed in 8.4.26
• 4.8
  CVE-2026-14355 ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD fixed in 8.4.23
• 4.3
  CVE-2026-91769 TLS Hostname Verification Falls Back to CN After SAN Mismatch fixed in 8.4.26
• 4.0
  CVE-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection fixed in 8.4.26
• 3.7
  GHSA-ch8v-r6jh-4vvr ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED fixed in 8.4.25
• 3.1
  CVE-2025-1218 Various packet overreads in mysqlnd_writeprotocol.c fixed in 8.4.26
• high
  CVE-2026-17544 Out-of-bounds write in bccomp() via crafted operand and scale fixed in 8.4.24
• high
  CVE-2026-17543 SQL injection in ext-pgsql via E'...' backslash breakout fixed in 8.4.24
• low
  CVE-2026-7259 Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() fixed in 8.4.21
• low
  CVE-2026-7568 Signed integer overflow in metaphone() fixed in 8.4.21

Newer releases