Repository navigation
Security: php/php-src
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location headerGHSA-7875-c8px-7q5f published
Sep 24, 2026 by bukkaModerate -
IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)GHSA-62xp-839h-2637 published
Sep 24, 2026 by bukkaModerate -
ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODEDGHSA-ch8v-r6jh-4vvr published
Sep 24, 2026 by bukkaLow -
ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PADGHSA-7jrw-539f-x6vr published
Jul 2, 2026 by bukkaModerate -
Cross-origin credential leak in HTTP stream wrapper redirectsGHSA-fpwc-w8rq-cr92 published
Sep 24, 2026 by bukkaModerate -
SOAP: Unbounded Recursion in Server-Side cleanup_xml_nodeGHSA-rgrp-mwpx-f6rm published
Sep 24, 2026 by bukkaHigh -
SQL injection in ext-pgsql via E'...' backslash breakoutGHSA-7qpv-r5mr-78m4 published
Jul 30, 2026 by iluuu1994High -
Out-of-bounds write in bccomp() via crafted operand and scaleGHSA-x692-q9x7-8c3f published
Jul 30, 2026 by iluuu1994High -
Failure to setup TLS with a remote server can result in a remote DoSGHSA-mhmq-mmqj-2v39 published
Jul 2, 2026 by bukkaHigh -
Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CNGHSA-xr7j-rvgx-xq5p published
Sep 24, 2026 by bukkaModerate