Every CVE Search/ Get API key

CVE-2026-12184

Low: php security, bug fix, and enhancement update

8.2 HighFix available

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

  • php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)

Bug Fix(es) and Enhancement(s):

  • Rebase PHP to 8.3.32 for CVE-2026-14355 CVE-2026-12184 in 10.2.z (JIRA:AlmaLinux-192618)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

What each source reports

OSV Score usedOESA-2026-3049 8.2

php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Security Fix(es):

(CVE-2026-12184)

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.(CVE-2026-14355)

Record
OESA-2026-3049
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSV Score usedOESA-2026-3050 8.2

php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Security Fix(es):

(CVE-2026-12184)

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.(CVE-2026-14355)

Record
OESA-2026-3050
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSV Score usedOESA-2026-3051 8.2

php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Security Fix(es):

(CVE-2026-12184)

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.(CVE-2026-14355)

Record
OESA-2026-3051
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVALSA-2026:48170 No score

Low: php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

  • php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)

Bug Fix(es) and Enhancement(s):

  • Rebase PHP to 8.3.32 for CVE-2026-14355 CVE-2026-12184 in 10.2.z (JIRA:AlmaLinux-192618)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:48170
Updated
2026-11-02
OSVALSA-2026:48197 No score

Low: php:8.3 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

  • php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)

Bug Fix(es) and Enhancement(s):

  • Rebase PHP to 8.3.32 for CVE-2026-14355 CVE-2026-12184 in 9.8.z (JIRA:AlmaLinux-192620)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:48197
Updated
2026-11-02
OSVopenSUSE-SU-2026:11269-1 No score

php8-8.5.8-1.1 on GA media

These are all security issues fixed in the php8-8.5.8-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11269-1
Updated
2026-11-02
Show 5 moreShow less
OSVopenSUSE-SU-2026:21308-1 No score

Security update for php8

This update for php8 fixes the following issues

  • Update to versio 8.4.23
  • CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw (bsc#1270351).
Record
openSUSE-SU-2026:21308-1
Updated
2026-11-02
OSVSUSE-SU-2026:22635-1 No score

Security update for php8

This update for php8 fixes the following issues

  • Update to versio 8.4.23
  • CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw (bsc#1270351).
Record
SUSE-SU-2026:22635-1
Updated
2026-11-02
OSVSUSE-SU-2026:3164-1 No score

Security update for php8

This update for php8 fixes the following issues

  • Update to version 8.3.32
  • CVE-2026-12184: Failure to setup TLS with a remote server can result in a remote DoS (bsc#1270712).
  • CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw (bsc#1270351).
Record
SUSE-SU-2026:3164-1
Updated
2026-11-02
OSVUBUNTU-CVE-2026-12184 No score

PHP: Failure to setup TLS with a remote server can result in a remote DoS

Record
UBUNTU-CVE-2026-12184
Updated
2026-11-02
OSVUSN-8564-1 No score

php8.1, php8.3, php8.5 vulnerabilities

It was discovered that PHP incorrectly handled certain TLS setup failures, resulting in a NULL pointer dereference. An attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-12184)

It was discovered that PHP contained a buffer allocation flaw in the OpenSSL extension when using the AES-WRAP-PAD algorithm. An attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-14355)

Record
USN-8564-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
php
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
php-bcmath
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
php-cli
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
php-common
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
php-dba
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
php-dbg
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
php-devel
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
php-embedded
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
php-enchant
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
php-ffi
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
Show 88 moreShow less
Affected packages
PackageAffectedFixed
php-fpm
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
php-gd
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
php-gmp
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
php-intl
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
php-ldap
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
php-mbstring
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
php-mysqlnd
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
php-odbc
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
php-opcache
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
php-pdo
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
php-pgsql
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
php-process
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
php-snmp
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
php-soap
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
php-xml
AlmaLinux:10
From an advisory covering 2 CVEs
 before 8.3.32-1.el10_2
8.3.32-1.el10_2
apcu-panel
AlmaLinux:9
From an advisory covering 2 CVEs
 before 5.1.23-1.module_el9.6.0+151+5f31e576
5.1.23-1.module_el9.6.0+151+5f31e576
php
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-bcmath
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-cli
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-common
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-dba
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-dbg
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-devel
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-embedded
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-enchant
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-ffi
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-fpm
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-gd
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-gmp
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-intl
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-ldap
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-mbstring
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-mysqlnd
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-odbc
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-opcache
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-pdo
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-pecl-apcu
AlmaLinux:9
From an advisory covering 2 CVEs
 before 5.1.23-1.module_el9.6.0+151+5f31e576
5.1.23-1.module_el9.6.0+151+5f31e576
php-pecl-apcu
AlmaLinux:9
From an advisory covering 2 CVEs
 before 5.1.23-1.module_el9.8.0+287+a9a5bb73
5.1.23-1.module_el9.8.0+287+a9a5bb73
php-pecl-apcu-devel
AlmaLinux:9
From an advisory covering 2 CVEs
 before 5.1.23-1.module_el9.8.0+287+a9a5bb73
5.1.23-1.module_el9.8.0+287+a9a5bb73
php-pecl-apcu-devel
AlmaLinux:9
From an advisory covering 2 CVEs
 before 5.1.23-1.module_el9.6.0+151+5f31e576
5.1.23-1.module_el9.6.0+151+5f31e576
php-pecl-redis6
AlmaLinux:9
From an advisory covering 2 CVEs
 before 6.1.0-3.module_el9.8.0+257+89d727f2
6.1.0-3.module_el9.8.0+257+89d727f2
php-pecl-rrd
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2.0.3-4.module_el9.8.0+287+a9a5bb73
2.0.3-4.module_el9.8.0+287+a9a5bb73
php-pecl-rrd
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2.0.3-4.module_el9.6.0+151+5f31e576
2.0.3-4.module_el9.6.0+151+5f31e576
php-pecl-xdebug3
AlmaLinux:9
From an advisory covering 2 CVEs
 before 3.3.1-1.module_el9.6.0+151+5f31e576
3.3.1-1.module_el9.6.0+151+5f31e576
php-pecl-xdebug3
AlmaLinux:9
From an advisory covering 2 CVEs
 before 3.3.1-1.module_el9.8.0+287+a9a5bb73
3.3.1-1.module_el9.8.0+287+a9a5bb73
php-pecl-zip
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1.22.3-1.module_el9.6.0+151+5f31e576
1.22.3-1.module_el9.6.0+151+5f31e576
php-pecl-zip
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1.22.3-1.module_el9.8.0+287+a9a5bb73
1.22.3-1.module_el9.8.0+287+a9a5bb73
php-pgsql
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-process
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-snmp
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-soap
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php-xml
AlmaLinux:9
From an advisory covering 2 CVEs
 before 8.3.32-1.module_el9.8.0+287+a9a5bb73
8.3.32-1.module_el9.8.0+287+a9a5bb73
php81
Alpaquita:23
 8.1.19-r0 and later None known
php83
Alpaquita:25
 8.3.21-r0 up to 8.3.32-r0
8.3.32-r0
php83
Alpaquita:stream
 8.3.4-r2 up to 8.3.32-r0
8.3.32-r0
php8.4
Debian:13
 before 8.4.21-1~deb13u1, plus listed versions
8.4.11-18.4.16-18.4.16-1~deb13u18.4.20-1
8.4.21-1~deb13u1
php8.4
Debian:14
 before 8.4.21-1, plus listed versions
8.4.11-18.4.16-18.4.16-1~deb13u18.4.20-18.4.21-1~deb13u1
8.4.21-1
php
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 8.3.32-1.oe2403sp1
8.3.32-1.oe2403sp1
php
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 8.3.32-1.oe2403sp3
8.3.32-1.oe2403sp3
php
openEuler:24.03-LTS-SP4
From an advisory covering 2 CVEs
 before 8.3.32-1.oe2403sp4
8.3.32-1.oe2403sp4
apache2-mod_php8
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8-embed
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8-fastcgi
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8-fpm
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
apache2-mod_php8
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8-embed
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8-fastcgi
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8-fpm
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
apache2-mod_php8
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 2 CVEs
 before 8.3.32-150700.3.15.1
8.3.32-150700.3.15.1
php8
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 2 CVEs
 before 8.3.32-150700.3.15.1
8.3.32-150700.3.15.1
php8-embed
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 2 CVEs
 before 8.3.32-150700.3.15.1
8.3.32-150700.3.15.1
php8-fastcgi
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 2 CVEs
 before 8.3.32-150700.3.15.1
8.3.32-150700.3.15.1
php8-fpm
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 2 CVEs
 before 8.3.32-150700.3.15.1
8.3.32-150700.3.15.1
php8-test
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 2 CVEs
 before 8.3.32-150700.3.15.1
8.3.32-150700.3.15.1
php8.4
Ubuntu:25.10
 All versions, plus listed versions
8.4.5-1ubuntu18.4.8-1ubuntu18.4.11-1ubuntu18.4.11-1ubuntu1.18.4.11-1ubuntu1.2
 None known
php8.5
Ubuntu:26.04:LTS
 before 8.5.4-0ubuntu1.2, plus listed versions
8.5.2-0ubuntu18.5.4-0ubuntu18.5.4-0ubuntu1.1
8.5.4-0ubuntu1.2
php8.1
Ubuntu:22.04:LTS
From an advisory covering 2 CVEs
 before 8.1.2-1ubuntu2.25, plus listed versions
8.1.0~rc4-1ubuntu28.1.0-18.1.2-1ubuntu18.1.2-1ubuntu28.1.2-1ubuntu2.1
Show 20 moreShow less
8.1.2-1ubuntu2.28.1.2-1ubuntu2.38.1.2-1ubuntu2.48.1.2-1ubuntu2.58.1.2-1ubuntu2.68.1.2-1ubuntu2.88.1.2-1ubuntu2.98.1.2-1ubuntu2.108.1.2-1ubuntu2.118.1.2-1ubuntu2.138.1.2-1ubuntu2.148.1.2-1ubuntu2.158.1.2-1ubuntu2.178.1.2-1ubuntu2.188.1.2-1ubuntu2.198.1.2-1ubuntu2.208.1.2-1ubuntu2.218.1.2-1ubuntu2.228.1.2-1ubuntu2.238.1.2-1ubuntu2.24
8.1.2-1ubuntu2.25
php8.3
Ubuntu:24.04:LTS
From an advisory covering 2 CVEs
 before 8.3.6-0ubuntu0.24.04.10, plus listed versions
8.3.0-18.3.0-1ubuntu18.3.4-18.3.4-1build18.3.6-0maysync1
Show 9 moreShow less
8.3.6-0ubuntu0.24.04.18.3.6-0ubuntu0.24.04.28.3.6-0ubuntu0.24.04.38.3.6-0ubuntu0.24.04.48.3.6-0ubuntu0.24.04.58.3.6-0ubuntu0.24.04.68.3.6-0ubuntu0.24.04.78.3.6-0ubuntu0.24.04.88.3.6-0ubuntu0.24.04.9
8.3.6-0ubuntu0.24.04.10
php8.5
Ubuntu:26.04:LTS
From an advisory covering 2 CVEs
 before 8.5.4-0ubuntu1.2, plus listed versions
8.5.2-0ubuntu18.5.4-0ubuntu18.5.4-0ubuntu1.1
8.5.4-0ubuntu1.2
php8
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 8.5.8-1.1
8.5.8-1.1
apache2-mod_php8
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8-embed
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8-fastcgi
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8-fpm
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8-test
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedOSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-12184 is a high vulnerability (CVSS 8.2) in php, published July 2, 2026. No source lists public exploit code. Fixed in php83 8.3.32-r0.

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open