Is PHP 8.4.2 affected?

Vulnerabilities affecting 8.4.2

• 9.4
  CVE-2026-6722 Use-After-Free in SOAP using Apache map with Remote Code Execution fixed in 8.4.21
• 9.2
  CVE-2026-109618 RCE via OOM corruption fixed in 8.4.27
• 9.2
  CVE-2026-109619 RCE via stale global state fixed in 8.4.27
• 9.2
  CVE-2025-14179 SQL injection in pdo_firebird via NUL bytes in quoted strings fixed in 8.4.21
• 8.2
  CVE-2026-12184 Failure to setup TLS with a remote server can result in a remote DoS fixed in 8.4.21
• 8.2
  CVE-2026-7263 DoS attack via DOMNode::C14N() fixed in 8.4.21
• 7.6
  CVE-2026-6735 XSS within PHP-FPM status endpoint fixed in 8.4.21
• 7.5
  CVE-2026-91765 SOAP: Unbounded Recursion in Server-Side cleanup_xml_node fixed in 8.4.26
• 6.9
  CVE-2026-17545 PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS fixed in 8.4.26
• 6.5
  CVE-2026-91768 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes) fixed in 8.4.26
• 6.5
  CVE-2026-91767 Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN fixed in 8.4.26
• 6.5
  CVE-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing fixed in 8.4.26
• 6.5
  CVE-2025-14178 Heap buffer overflow in array_merge() fixed in 8.4.16
• 6.3
  CVE-2026-7262 NULL pointer dereference in SOAP apache:Map decoder with missing <value> fixed in 8.4.21
• 6.3
  CVE-2026-7261 SoapServer session-persisted object use-after-free via SOAP header fault fixed in 8.4.21
• 6.3
  CVE-2026-7258 Out-of-bounds read in urldecode() fixed in 8.4.21
• 6.3
  CVE-2026-6104 Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding fixed in 8.4.21
• 6.3
  CVE-2025-14180 NULL Pointer Dereference in PDO quoting fixed in 8.4.16
• 6.3
  CVE-2025-14177 Information Leak of Memory in getimagesize fixed in 8.4.16
• 5.9
  CVE-2026-92842 OOB read / info leak in convert.* stream filters when line-break-chars contains NUL fixed in 8.4.26
• 5.9
  CVE-2026-91766 Cross-origin credential leak in HTTP stream wrapper redirects fixed in 8.4.26
• 5.9
  CVE-2025-6491 NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix fixed in 8.4.10
• 5.5
  CVE-2026-7260 Stack overflow in phar with circular symlinks fixed in 8.4.24
• 5.3
  CVE-2026-93682 Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header fixed in 8.4.26
• 4.8
  CVE-2026-14355 ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD fixed in 8.4.23
• 4.3
  CVE-2026-91769 TLS Hostname Verification Falls Back to CN After SAN Mismatch fixed in 8.4.26
• 4.0
  CVE-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection fixed in 8.4.26
• 3.7
  GHSA-ch8v-r6jh-4vvr ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED fixed in 8.4.25
• 3.1
  CVE-2025-1218 Various packet overreads in mysqlnd_writeprotocol.c fixed in 8.4.26
• high
  CVE-2026-17544 Out-of-bounds write in bccomp() via crafted operand and scale fixed in 8.4.24
• high
  CVE-2026-17543 SQL injection in ext-pgsql via E'...' backslash breakout fixed in 8.4.24
• low
  CVE-2026-7259 Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() fixed in 8.4.21
• low
  CVE-2026-7568 Signed integer overflow in metaphone() fixed in 8.4.21
• low
  GHSA-www2-q4fc-65wf Null byte termination in dns_get_record() fixed in 8.4.16
• medium
  CVE-2025-1735 pgsql extension does not check for errors during escaping fixed in 8.4.10
• low
  CVE-2025-1220 Null byte termination in hostnames fixed in 8.4.10
• medium
  CVE-2024-11235 Reference counting in php_request_shutdown causes Use-After-Free fixed in 8.4.5
• low
  GHSA-wg4p-4hqh-c3g9 Possible out of bounds read when XML_OPTION_SKIP_TAGSTART used fixed in 8.4.5
• medium
  CVE-2025-1219 libxml streams use wrong `content-type` header when requesting a redirected resource fixed in 8.4.5
• medium
  CVE-2025-1736 Stream HTTP wrapper header check might omit basic auth header fixed in 8.4.5
• medium
  CVE-2025-1861 Stream HTTP wrapper truncate redirect location to 1024 bytes fixed in 8.4.5
• medium
  CVE-2025-1734 Streams HTTP wrapper does not fail for headers with invalid name and no colon fixed in 8.4.5
• medium
  CVE-2025-1217 Header parser of `http` stream wrapper does not handle folded headers fixed in 8.4.5

Newer releases