Vulnerability-Lookup

RHSA-2026:1412

Vulnerability from csaf_redhat - Published: 2026-01-27 17:44 - Updated: 2026-07-22 20:40

Summary

Red Hat Security Advisory: php:8.2 security update

Severity

Important

Notes

Topic: An update for the php:8.2 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: pgsql extension does not check for errors during escaping (CVE-2025-1735) * php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491) * php: PHP Hostname Null Character Vulnerability (CVE-2025-1220) * php: heap-based buffer overflow in array_merge() (CVE-2025-14178) * php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177) * php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement (CVE-2025-14180) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2025-1220

A flaw was found in PHP. The `fsockopen()` function and related functions fail to validate NULL characters within the provided hostname, potentially leading to unexpected behavior during parsing. This flaw allows a network attacker to supply a specially crafted hostname. This issue can result in a denial of service due to parsing errors.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-918 - Server-Side Request Forgery (SSRF)

Affected products

Fixed 285 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:apcu-panel-0:5.1.23-1.module+el8.10.0+20770+a5eca186.noarch::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-0:1.7.3-1.module+el8.10.0+20770+a5eca186.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-0:1.7.3-1.module+el8.10.0+20770+a5eca186.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-0:1.7.3-1.module+el8.10.0+20770+a5eca186.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-0:1.7.3-1.module+el8.10.0+20770+a5eca186.src::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-0:1.7.3-1.module+el8.10.0+20770+a5eca186.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-debuginfo-0:1.7.3-1.module+el8.10.0+20770+a5eca186.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-debuginfo-0:1.7.3-1.module+el8.10.0+20770+a5eca186.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-debuginfo-0:1.7.3-1.module+el8.10.0+20770+a5eca186.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-debuginfo-0:1.7.3-1.module+el8.10.0+20770+a5eca186.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-debugsource-0:1.7.3-1.module+el8.10.0+20770+a5eca186.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-debugsource-0:1.7.3-1.module+el8.10.0+20770+a5eca186.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-debugsource-0:1.7.3-1.module+el8.10.0+20770+a5eca186.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-debugsource-0:1.7.3-1.module+el8.10.0+20770+a5eca186.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-devel-0:1.7.3-1.module+el8.10.0+20770+a5eca186.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-devel-0:1.7.3-1.module+el8.10.0+20770+a5eca186.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-devel-0:1.7.3-1.module+el8.10.0+20770+a5eca186.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-devel-0:1.7.3-1.module+el8.10.0+20770+a5eca186.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-tools-0:1.7.3-1.module+el8.10.0+20770+a5eca186.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-tools-0:1.7.3-1.module+el8.10.0+20770+a5eca186.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-tools-0:1.7.3-1.module+el8.10.0+20770+a5eca186.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-tools-0:1.7.3-1.module+el8.10.0+20770+a5eca186.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-tools-debuginfo-0:1.7.3-1.module+el8.10.0+20770+a5eca186.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-tools-debuginfo-0:1.7.3-1.module+el8.10.0+20770+a5eca186.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-tools-debuginfo-0:1.7.3-1.module+el8.10.0+20770+a5eca186.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:libzip-tools-debuginfo-0:1.7.3-1.module+el8.10.0+20770+a5eca186.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-0:8.2.30-1.module+el8.10.0+23848+33d54484.src::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-bcmath-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-bcmath-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-bcmath-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-bcmath-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-bcmath-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-bcmath-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-bcmath-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-bcmath-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-cli-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-cli-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-cli-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-cli-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-cli-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-cli-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-cli-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-cli-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-common-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-common-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-common-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-common-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-common-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-common-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-common-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-common-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dba-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dba-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dba-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dba-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dba-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dba-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dba-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dba-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dbg-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dbg-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dbg-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dbg-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dbg-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dbg-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dbg-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-dbg-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-debugsource-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-debugsource-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-debugsource-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-debugsource-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-devel-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-devel-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-devel-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-devel-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-embedded-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-embedded-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-embedded-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-embedded-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-embedded-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-embedded-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-embedded-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-embedded-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-enchant-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-enchant-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-enchant-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-enchant-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-enchant-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-enchant-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-enchant-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-enchant-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ffi-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ffi-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ffi-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ffi-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ffi-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ffi-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ffi-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ffi-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-fpm-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-fpm-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-fpm-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-fpm-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-fpm-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-fpm-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-fpm-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-fpm-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gd-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gd-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gd-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gd-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gd-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gd-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gd-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gd-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gmp-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gmp-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gmp-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gmp-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gmp-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gmp-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gmp-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-gmp-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-intl-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-intl-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-intl-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-intl-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-intl-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-intl-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-intl-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-intl-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ldap-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ldap-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ldap-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ldap-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ldap-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ldap-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ldap-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-ldap-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mbstring-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mbstring-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mbstring-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mbstring-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mbstring-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mbstring-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mbstring-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mbstring-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mysqlnd-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mysqlnd-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mysqlnd-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mysqlnd-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mysqlnd-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mysqlnd-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mysqlnd-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-mysqlnd-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-odbc-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-odbc-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-odbc-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-odbc-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-odbc-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-odbc-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-odbc-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-odbc-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-opcache-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-opcache-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-opcache-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-opcache-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-opcache-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-opcache-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-opcache-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-opcache-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pdo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pdo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pdo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pdo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pdo-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pdo-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pdo-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pdo-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pear-1:1.10.14-1.module+el8.10.0+20770+a5eca186.noarch::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pear-1:1.10.14-1.module+el8.10.0+20770+a5eca186.src::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-0:5.1.23-1.module+el8.10.0+20770+a5eca186.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-0:5.1.23-1.module+el8.10.0+20770+a5eca186.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-0:5.1.23-1.module+el8.10.0+20770+a5eca186.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-0:5.1.23-1.module+el8.10.0+20770+a5eca186.src::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-0:5.1.23-1.module+el8.10.0+20770+a5eca186.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-debuginfo-0:5.1.23-1.module+el8.10.0+20770+a5eca186.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-debuginfo-0:5.1.23-1.module+el8.10.0+20770+a5eca186.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-debuginfo-0:5.1.23-1.module+el8.10.0+20770+a5eca186.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-debuginfo-0:5.1.23-1.module+el8.10.0+20770+a5eca186.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-debugsource-0:5.1.23-1.module+el8.10.0+20770+a5eca186.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-debugsource-0:5.1.23-1.module+el8.10.0+20770+a5eca186.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-debugsource-0:5.1.23-1.module+el8.10.0+20770+a5eca186.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-debugsource-0:5.1.23-1.module+el8.10.0+20770+a5eca186.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-devel-0:5.1.23-1.module+el8.10.0+20770+a5eca186.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-devel-0:5.1.23-1.module+el8.10.0+20770+a5eca186.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-devel-0:5.1.23-1.module+el8.10.0+20770+a5eca186.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-apcu-devel-0:5.1.23-1.module+el8.10.0+20770+a5eca186.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-0:2.0.3-1.module+el8.10.0+20770+a5eca186.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-0:2.0.3-1.module+el8.10.0+20770+a5eca186.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-0:2.0.3-1.module+el8.10.0+20770+a5eca186.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-0:2.0.3-1.module+el8.10.0+20770+a5eca186.src::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-0:2.0.3-1.module+el8.10.0+20770+a5eca186.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-debuginfo-0:2.0.3-1.module+el8.10.0+20770+a5eca186.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-debuginfo-0:2.0.3-1.module+el8.10.0+20770+a5eca186.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-debuginfo-0:2.0.3-1.module+el8.10.0+20770+a5eca186.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-debuginfo-0:2.0.3-1.module+el8.10.0+20770+a5eca186.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-debugsource-0:2.0.3-1.module+el8.10.0+20770+a5eca186.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-debugsource-0:2.0.3-1.module+el8.10.0+20770+a5eca186.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-debugsource-0:2.0.3-1.module+el8.10.0+20770+a5eca186.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-rrd-debugsource-0:2.0.3-1.module+el8.10.0+20770+a5eca186.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug3-0:3.2.2-2.module+el8.10.0+20798+00eaeb41.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug3-0:3.2.2-2.module+el8.10.0+20798+00eaeb41.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug3-0:3.2.2-2.module+el8.10.0+20798+00eaeb41.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug3-0:3.2.2-2.module+el8.10.0+20798+00eaeb41.src::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug3-0:3.2.2-2.module+el8.10.0+20798+00eaeb41.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug3-debuginfo-0:3.2.2-2.module+el8.10.0+20798+00eaeb41.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug3-debuginfo-0:3.2.2-2.module+el8.10.0+20798+00eaeb41.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug3-debuginfo-0:3.2.2-2.module+el8.10.0+20798+00eaeb41.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug3-debuginfo-0:3.2.2-2.module+el8.10.0+20798+00eaeb41.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug3-debugsource-0:3.2.2-2.module+el8.10.0+20798+00eaeb41.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug3-debugsource-0:3.2.2-2.module+el8.10.0+20798+00eaeb41.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug3-debugsource-0:3.2.2-2.module+el8.10.0+20798+00eaeb41.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-xdebug3-debugsource-0:3.2.2-2.module+el8.10.0+20798+00eaeb41.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-0:1.22.3-1.module+el8.10.0+20770+a5eca186.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-0:1.22.3-1.module+el8.10.0+20770+a5eca186.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-0:1.22.3-1.module+el8.10.0+20770+a5eca186.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-0:1.22.3-1.module+el8.10.0+20770+a5eca186.src::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-0:1.22.3-1.module+el8.10.0+20770+a5eca186.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-debuginfo-0:1.22.3-1.module+el8.10.0+20770+a5eca186.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-debuginfo-0:1.22.3-1.module+el8.10.0+20770+a5eca186.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-debuginfo-0:1.22.3-1.module+el8.10.0+20770+a5eca186.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-debuginfo-0:1.22.3-1.module+el8.10.0+20770+a5eca186.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-debugsource-0:1.22.3-1.module+el8.10.0+20770+a5eca186.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-debugsource-0:1.22.3-1.module+el8.10.0+20770+a5eca186.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-debugsource-0:1.22.3-1.module+el8.10.0+20770+a5eca186.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pecl-zip-debugsource-0:1.22.3-1.module+el8.10.0+20770+a5eca186.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pgsql-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pgsql-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pgsql-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pgsql-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pgsql-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pgsql-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pgsql-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-pgsql-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-process-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-process-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-process-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-process-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-process-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-process-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-process-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-process-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-snmp-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-snmp-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-snmp-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-snmp-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-snmp-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-snmp-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-snmp-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-snmp-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-soap-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-soap-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-soap-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-soap-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-soap-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-soap-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-soap-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-soap-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xml-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xml-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xml-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xml-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xml-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.aarch64::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xml-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.ppc64le::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xml-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.s390x::php:8.2	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:php-xml-debuginfo-0:8.2.30-1.module+el8.10.0+23848+33d54484.x86_64::php:8.2	—	Vendor Fix fix Workaround

Threats

Impact Low

CVE-2025-1735

A flaw was found in PHP. Missing error checking could result in SQL injection, and missing error handling could lead to crashes due to null pointer dereferences.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 285 products, the same list as for CVE-2025-1220

Threats

Impact Moderate

CVE-2025-6491

A vulnerability was found in PHP. If a SoapVar instance is created with a fully qualified name larger than 2G, this will cause a NULL pointer dereference resulting in a segmentation fault, leading to a denial of service.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 285 products, the same list as for CVE-2025-1220

Threats

Impact Moderate

CVE-2025-14177

A flaw was found in PHP. The getimagesize() function may leak uninitialized heap memory when processing images in multi-chunk mode, such as through php://filter. This vulnerability, caused by a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, allows an attacker to potentially disclose sensitive information from the server's memory. This could compromise the confidentiality of data on the affected server.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Fixed 285 products, the same list as for CVE-2025-1220

Threats

Impact Low

CVE-2025-14178

A flaw was found in PHP. A heap-based buffer overflow occurs in the array_merge function when the total element count of packed arrays exceeds the 32-bit limit or the internal HT_MAX_SIZE due to an integer overflow in the precomputation of element counts using the zend_hash_num_elements function, causing a process crash and potentially memory corruption.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 285 products, the same list as for CVE-2025-1220

Threats

Impact Moderate

CVE-2025-14180

A flaw was found in PHP. When the PDO (PHP Data Objects) PostgreSQL driver is configured with `PDO::ATTR_EMULATE_PREPARES` enabled, a remote attacker can exploit a vulnerability by providing an invalid character sequence within a prepared statement parameter. This can cause a null pointer dereference, leading to a server crash. The primary impact is a Denial of Service (DoS), affecting the availability of the target server.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 285 products, the same list as for CVE-2025-1220

Threats

Impact Important

References

39 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:1412	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2378689	external
https://bugzilla.redhat.com/show_bug.cgi?id=2378690	external
https://bugzilla.redhat.com/show_bug.cgi?id=2379792	external
https://bugzilla.redhat.com/show_bug.cgi?id=2425625	external
https://bugzilla.redhat.com/show_bug.cgi?id=2425626	external
https://bugzilla.redhat.com/show_bug.cgi?id=2425627	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2025-1220	self
https://bugzilla.redhat.com/show_bug.cgi?id=2379792	external
https://www.cve.org/CVERecord?id=CVE-2025-1220	external
https://nvd.nist.gov/vuln/detail/CVE-2025-1220	external
https://github.com/php/php-src/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2025-1735	self
https://bugzilla.redhat.com/show_bug.cgi?id=2378689	external
https://www.cve.org/CVERecord?id=CVE-2025-1735	external
https://nvd.nist.gov/vuln/detail/CVE-2025-1735	external
https://github.com/php/php-src/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2025-6491	self
https://bugzilla.redhat.com/show_bug.cgi?id=2378690	external
https://www.cve.org/CVERecord?id=CVE-2025-6491	external
https://nvd.nist.gov/vuln/detail/CVE-2025-6491	external
https://github.com/php/php-src/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2025-14177	self
https://bugzilla.redhat.com/show_bug.cgi?id=2425626	external
https://www.cve.org/CVERecord?id=CVE-2025-14177	external
https://nvd.nist.gov/vuln/detail/CVE-2025-14177	external
https://github.com/php/php-src/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2025-14178	self
https://bugzilla.redhat.com/show_bug.cgi?id=2425625	external
https://www.cve.org/CVERecord?id=CVE-2025-14178	external
https://nvd.nist.gov/vuln/detail/CVE-2025-14178	external
https://github.com/php/php-src/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2025-14180	self
https://bugzilla.redhat.com/show_bug.cgi?id=2425627	external
https://www.cve.org/CVERecord?id=CVE-2025-14180	external
https://nvd.nist.gov/vuln/detail/CVE-2025-14180	external
https://github.com/php/php-src/security/advisorie…	external

JSON

To clipboard

Loading 1.1 MB of JSON…

CVE-2025-1220 (GCVE-0-2025-1220)

Vulnerability from cvelistv5 – Published: 2025-07-13 22:18 – Updated: 2025-11-04 21:09

Title

Null byte termination in hostnames

Summary

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-14 15:58 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

php mitre root

References

3 references

URL	Tags
https://github.com/php/php-src/security/advisorie…
https://lists.debian.org/debian-lts-announce/2025…
http://www.openwall.com/lists/oss-security/2025/07/11/4

Impacted products

1 product

Vendor	Product	Version
PHP Group	PHP	Affected: 8.1.* , < 8.1.33 (semver) Affected: 8.2.* , < 8.2.29 (semver) Affected: 8.3.* , < 8.3.23 (semver) Affected: 8.4.* , < 8.4.10 (semver)

Date Public

2025-07-03 12:27

Credits

Jihwan Kim

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1220",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-14T15:58:46.330104Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-14T15:58:49.718Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:09:17.792Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00017.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/07/11/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.1.33",
              "status": "affected",
              "version": "8.1.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.2.29",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.23",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.4.10",
              "status": "affected",
              "version": "8.4.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jihwan Kim"
        }
      ],
      "datePublic": "2025-07-03T12:27:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.\u0026nbsp;"
            }
          ],
          "value": "In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-13T22:18:36.974Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "url": "https://github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r"
        }
      ],
      "source": {
        "advisory": "GHSA-453j-q27h-5p8x",
        "discovery": "EXTERNAL"
      },
      "title": "Null byte termination in hostnames",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2025-1220",
    "datePublished": "2025-07-13T22:18:36.974Z",
    "dateReserved": "2025-02-11T04:54:48.211Z",
    "dateUpdated": "2025-11-04T21:09:17.792Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14177 (GCVE-0-2025-14177)

Vulnerability from cvelistv5 – Published: 2025-12-27 19:33 – Updated: 2025-12-29 16:01

Title

Information Leak of Memory in getimagesize

Summary

In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-29 16:01 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

php mitre root

References

1 reference

URL	Tags
https://github.com/php/php-src/security/advisorie…

Impacted products

1 product

Vendor	Product	Version
PHP Group	PHP	Affected: 8.1.* , < 8.1.34 (semver) Affected: 8.2.* , < 8.2.30 (semver) Affected: 8.3.* , < 8.3.29 (semver) Affected: 8.4.* , < 8.4.16 (semver) Affected: 8.5.* , < 8.5.1 (semver)

Date Public

2025-12-18 00:00

Credits

Nikita Sveshnikov (Positive Technologies)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14177",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-29T16:01:25.714908Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-29T16:01:36.231Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageName": "php",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.1.34",
              "status": "affected",
              "version": "8.1.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.2.30",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.29",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.4.16",
              "status": "affected",
              "version": "8.4.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.1",
              "status": "affected",
              "version": "8.5.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Nikita Sveshnikov (Positive Technologies)"
        }
      ],
      "datePublic": "2025-12-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.\u003c/p\u003e"
            }
          ],
          "value": "In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-27T19:33:23.973Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "url": "https://github.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7"
        }
      ],
      "source": {
        "advisory": "GHSA-3237-qqm7-mfv7",
        "discovery": "EXTERNAL"
      },
      "title": "Information Leak of Memory in getimagesize",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2025-14177",
    "datePublished": "2025-12-27T19:33:23.973Z",
    "dateReserved": "2025-12-06T06:23:06.907Z",
    "dateUpdated": "2025-12-29T16:01:36.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14178 (GCVE-0-2025-14178)

Vulnerability from cvelistv5 – Published: 2025-12-27 19:27 – Updated: 2026-01-24 11:04

Title

Heap buffer overflow in array_merge()

Summary

In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-29 16:00 UTC

CWE

CWE-787 - Out-of-bounds Write
CWE-190 - Integer Overflow or Wraparound

Assigner

php mitre root

References

2 references

URL	Tags
https://github.com/php/php-src/security/advisorie…
https://lists.debian.org/debian-lts-announce/2026…

Impacted products

1 product

Vendor	Product	Version
PHP Group	PHP	Affected: 8.1.* , < 8.1.34 (semver) Affected: 8.2.* , < 8.2.30 (semver) Affected: 8.3.* , < 8.3.29 (semver) Affected: 8.4.* , < 8.4.16 (semver) Affected: 8.5.* , < 8.5.1 (semver)

Date Public

2025-12-18 00:00

Credits

Niels Dossche

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14178",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-29T16:00:50.197017Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-29T16:01:02.639Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-24T11:04:01.892Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00019.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageName": "php",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.1.34",
              "status": "affected",
              "version": "8.1.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.2.30",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.29",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.4.16",
              "status": "affected",
              "version": "8.4.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.1",
              "status": "affected",
              "version": "8.5.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Niels Dossche"
        }
      ],
      "datePublic": "2025-12-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.\u003c/p\u003e"
            }
          ],
          "value": "In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-27T19:27:41.691Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "url": "https://github.com/php/php-src/security/advisories/GHSA-h96m-rvf9-jgm2"
        }
      ],
      "source": {
        "advisory": "GHSA-h96m-rvf9-jgm2",
        "discovery": "INTERNAL"
      },
      "title": "Heap buffer overflow in array_merge()",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2025-14178",
    "datePublished": "2025-12-27T19:27:41.691Z",
    "dateReserved": "2025-12-06T06:25:31.535Z",
    "dateUpdated": "2026-01-24T11:04:01.892Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14180 (GCVE-0-2025-14180)

Vulnerability from cvelistv5 – Published: 2025-12-27 19:21 – Updated: 2025-12-29 16:00

Title

NULL Pointer Dereference in PDO quoting

Summary

In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-29 15:59 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

php mitre root

References

1 reference

URL	Tags
https://github.com/php/php-src/security/advisorie…

Impacted products

1 product

Vendor	Product	Version
PHP Group	PHP	Affected: 8.1.* , < 8.1.34 (semver) Affected: 8.2.* , < 8.2.30 (semver) Affected: 8.3.* , < 8.3.29 (semver) Affected: 8.4.* , < 8.4.16 (semver) Affected: 8.5.* , < 8.5.1 (semver)

Date Public

2025-12-18 00:00

Credits

Aleksey Solovev (Positive Technologies)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14180",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-29T15:59:59.281968Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-29T16:00:11.239Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageName": "pdo",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.1.34",
              "status": "affected",
              "version": "8.1.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.2.30",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.29",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.4.16",
              "status": "affected",
              "version": "8.4.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.1",
              "status": "affected",
              "version": "8.5.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Aleksey Solovev (Positive Technologies)"
        }
      ],
      "datePublic": "2025-12-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \\x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.\u003cbr\u003e"
            }
          ],
          "value": "In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \\x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-27T19:21:20.768Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "url": "https://github.com/php/php-src/security/advisories/GHSA-8xr5-qppj-gvwj"
        }
      ],
      "source": {
        "advisory": "GHSA-8xr5-qppj-gvwj",
        "discovery": "EXTERNAL"
      },
      "title": "NULL Pointer Dereference in PDO quoting",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2025-14180",
    "datePublished": "2025-12-27T19:21:20.768Z",
    "dateReserved": "2025-12-06T06:43:11.174Z",
    "dateUpdated": "2025-12-29T16:00:11.239Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-1735 (GCVE-0-2025-1735)

Vulnerability from cvelistv5 – Published: 2025-07-13 22:27 – Updated: 2025-11-04 21:09

Title

pgsql extension does not check for errors during escaping

Summary

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-14 15:58 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-476 - NULL Pointer Dereference

Assigner

php mitre root

References

3 references

URL	Tags
https://github.com/php/php-src/security/advisorie…
https://lists.debian.org/debian-lts-announce/2025…
http://www.openwall.com/lists/oss-security/2025/07/11/4

Impacted products

1 product

Vendor	Product	Version
PHP Group	PHP	Affected: 8.1.* , < 8.1.33 (semver) Affected: 8.2.* , < 8.2.29 (semver) Affected: 8.3.* , < 8.3.23 (semver) Affected: 8.4.* , < 8.4.10 (semver)

Date Public

2025-07-03 12:27

Credits

Andres Freund

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1735",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-14T15:58:08.629332Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-14T15:58:13.474Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:09:33.172Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00017.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/07/11/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "modules": [
            "pgsql",
            "pdo_pgsql"
          ],
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.1.33",
              "status": "affected",
              "version": "8.1.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.2.29",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.23",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.4.10",
              "status": "affected",
              "version": "8.4.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andres Freund"
        }
      ],
      "datePublic": "2025-07-03T12:27:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This\u0026nbsp;could cause crashes if Postgres server rejects the string as invalid.\u0026nbsp;"
            }
          ],
          "value": "In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This\u00a0could cause crashes if Postgres server rejects the string as invalid."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-13T22:27:48.299Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "url": "https://github.com/php/php-src/security/advisories/GHSA-hrwm-9436-5mv3"
        }
      ],
      "source": {
        "advisory": "GHSA-hrwm-9436-5mv3",
        "discovery": "EXTERNAL"
      },
      "title": "pgsql extension does not check for errors during escaping",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2025-1735",
    "datePublished": "2025-07-13T22:27:48.299Z",
    "dateReserved": "2025-02-27T04:04:57.553Z",
    "dateUpdated": "2025-11-04T21:09:33.172Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-6491 (GCVE-0-2025-6491)

Vulnerability from cvelistv5 – Published: 2025-07-13 22:10 – Updated: 2025-11-04 21:14

Title

NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

Summary

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-14 15:59 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

php mitre root

References

3 references

URL	Tags
https://github.com/php/php-src/security/advisorie…
https://lists.debian.org/debian-lts-announce/2025…
http://www.openwall.com/lists/oss-security/2025/07/11/4

Impacted products

1 product

Vendor	Product	Version
PHP Group	PHP	Affected: 8.1.* , < 8.1.33 (semver) Affected: 8.2.* , < 8.2.29 (semver) Affected: 8.3.* , < 8.3.23 (semver) Affected: 8.4.* , < 8.4.10 (semver)

Date Public

2025-07-03 12:27

Credits

Ahmed Lekssays

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-6491",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-14T15:59:51.249317Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-14T15:59:53.756Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:14:48.898Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00017.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/07/11/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageName": "soap",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.1.33",
              "status": "affected",
              "version": "8.1.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.2.29",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.23",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.4.10",
              "status": "affected",
              "version": "8.4.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ahmed Lekssays"
        }
      ],
      "datePublic": "2025-07-03T12:27:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (\u0026gt;2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (\u003e2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-13T22:10:15.996Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "url": "https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x"
        }
      ],
      "source": {
        "advisory": "GHSA-453j-q27h-5p8x",
        "discovery": "EXTERNAL"
      },
      "title": "NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2025-6491",
    "datePublished": "2025-07-13T22:10:15.996Z",
    "dateReserved": "2025-06-22T03:05:22.008Z",
    "dateUpdated": "2025-11-04T21:14:48.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:1412

CVE-2025-1220 (GCVE-0-2025-1220)

CVE-2025-14177 (GCVE-0-2025-14177)

CVE-2025-14178 (GCVE-0-2025-14178)

CVE-2025-14180 (GCVE-0-2025-14180)

CVE-2025-1735 (GCVE-0-2025-1735)

CVE-2025-6491 (GCVE-0-2025-6491)

Tags

Sightings

Nomenclature