Is PHP 8.4.22 affected?

Vulnerabilities affecting 8.4.22

• 9.2
  CVE-2026-109618 RCE via OOM corruption fixed in 8.4.27
• 9.2
  CVE-2026-109619 RCE via stale global state fixed in 8.4.27
• 7.5
  CVE-2026-91765 SOAP: Unbounded Recursion in Server-Side cleanup_xml_node fixed in 8.4.26
• 6.9
  CVE-2026-17545 PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS fixed in 8.4.26
• 6.5
  CVE-2026-91768 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes) fixed in 8.4.26
• 6.5
  CVE-2026-91767 Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN fixed in 8.4.26
• 6.5
  CVE-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing fixed in 8.4.26
• 5.9
  CVE-2026-92842 OOB read / info leak in convert.* stream filters when line-break-chars contains NUL fixed in 8.4.26
• 5.9
  CVE-2026-91766 Cross-origin credential leak in HTTP stream wrapper redirects fixed in 8.4.26
• 5.5
  CVE-2026-7260 Stack overflow in phar with circular symlinks fixed in 8.4.24
• 5.3
  CVE-2026-93682 Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header fixed in 8.4.26
• 4.8
  CVE-2026-14355 ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD fixed in 8.4.23
• 4.3
  CVE-2026-91769 TLS Hostname Verification Falls Back to CN After SAN Mismatch fixed in 8.4.26
• 4.0
  CVE-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection fixed in 8.4.26
• 3.7
  GHSA-ch8v-r6jh-4vvr ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED fixed in 8.4.25
• 3.1
  CVE-2025-1218 Various packet overreads in mysqlnd_writeprotocol.c fixed in 8.4.26
• high
  CVE-2026-17544 Out-of-bounds write in bccomp() via crafted operand and scale fixed in 8.4.24
• high
  CVE-2026-17543 SQL injection in ext-pgsql via E'...' backslash breakout fixed in 8.4.24

Newer releases