Every CVE Search/ Get API key

CVE-2026-14355

ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD

5.6 MediumFix available

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.28%Unchanged since Jul 4, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.6

ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

Record
CVE-2026-14355
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-122
Updated
2026-11-02
EUVDEUVD-2026-41609 5.6

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

Record
EUVD-2026-41609
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
NVD 5.6

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

Record
CVE-2026-14355
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-122
Updated
2026-11-02
OSVALPINE-CVE-2026-14355 5.3

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

Record
ALPINE-CVE-2026-14355
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-03
OSVBELL-CVE-2026-14355 5.3
Record
BELL-CVE-2026-14355
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2026-14355 5.3

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

Record
DEBIAN-CVE-2026-14355
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 42 moreShow less
OSVOESA-2026-3048 4.8

php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.

Security Fix(es):

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.(CVE-2026-14355)

Record
OESA-2026-3048
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-3049 8.2

php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Security Fix(es):

(CVE-2026-12184)

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.(CVE-2026-14355)

Record
OESA-2026-3049
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVOESA-2026-3050 8.2

php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Security Fix(es):

(CVE-2026-12184)

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.(CVE-2026-14355)

Record
OESA-2026-3050
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVOESA-2026-3051 8.2

php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Security Fix(es):

(CVE-2026-12184)

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.(CVE-2026-14355)

Record
OESA-2026-3051
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVOESA-2026-3052 4.8

php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.

Security Fix(es):

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.(CVE-2026-14355)

Record
OESA-2026-3052
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVRHSA-2026:34164 5.6

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:34164
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:40416 5.6

Red Hat Security Advisory: php:8.2 security, bug fix, and enhancement update

Record
RHSA-2026:40416
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:47749 5.6

Red Hat Security Advisory: php:8.2 security, bug fix, and enhancement update

Record
RHSA-2026:47749
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:47750 5.6

Red Hat Security Advisory: php:7.4 security, bug fix, and enhancement update

Record
RHSA-2026:47750
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:48170 5.6

Red Hat Security Advisory: php security, bug fix, and enhancement update

Record
RHSA-2026:48170
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:48197 5.6

Red Hat Security Advisory: php:8.3 security, bug fix, and enhancement update

Record
RHSA-2026:48197
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:49914 5.6

Red Hat Security Advisory: php8.4 security, bug fix, and enhancement update

Record
RHSA-2026:49914
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:61259 7.4

Red Hat Security Advisory: php security, bug fix, and enhancement update

Record
RHSA-2026:61259
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:40416 5.6

Low: php:8.2 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

  • php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)

Bug Fix(es) and Enhancement(s):

  • Rebase PHP to 8.2.32 for CVE-2026-14355 in 9.8.z (JIRA:Rocky Linux-192622)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:40416
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRLSA-2026:47749 5.6

Low: php:8.2 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

  • php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)

Bug Fix(es) and Enhancement(s):

  • Rebase PHP to 8.2.32 for CVE-2026-14355 in 8.10.z (JIRA:Rocky Linux-192626)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:47749
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRLSA-2026:47750 5.6

Low: php:7.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

  • php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)

Bug Fix(es) and Enhancement(s):

  • Backport fix for CVE-2026-14355 to PHP 7.4 in 8.10.z (JIRA:Rocky Linux-192629)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:47750
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRLSA-2026:48170 5.6

Low: php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

  • php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)

Bug Fix(es) and Enhancement(s):

  • Rebase PHP to 8.3.32 for CVE-2026-14355 CVE-2026-12184 in 10.2.z (JIRA:Rocky Linux-192618)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:48170
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRLSA-2026:48197 5.6

Low: php:8.3 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

  • php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)

Bug Fix(es) and Enhancement(s):

  • Rebase PHP to 8.3.32 for CVE-2026-14355 CVE-2026-12184 in 9.8.z (JIRA:Rocky Linux-192620)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:48197
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRLSA-2026:49914 5.6

Low: php8.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.

Security Fix(es):

  • php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)

Bug Fix(es) and Enhancement(s):

  • Rebase PHP to 8.4.23 for CVE-2026-14355 in 10.2.z (JIRA:Rocky Linux-192616)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:49914
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRLSA-2026:61259 7.4

Low: php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

  • php: ext/openssl: memory corruption in openssl_encrypt with AES-WRAP-PAD (CVE-2026-14355)

  • php: ext-pgsql: PHP: SQL injection via improper backslash escaping (CVE-2026-17543)

  • php: PHP: Denial of Service via circular symbolic links in phar archives (CVE-2026-7260)

Bug Fix(es) and Enhancement(s):

  • Backport fix for CVE-2026-14355 to PHP 8.0 in 9.8.z (JIRA:Rocky Linux-192624)

  • Backport fix for CVE-2026-17543 and CVE-2026-7260 to PHP 8.0 in 9.8.z (JIRA:Rocky Linux-223940)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:61259
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-14355 5.6

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

Record
UBUNTU-CVE-2026-14355
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVALSA-2026:40416 No score

Low: php:8.2 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

  • php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)

Bug Fix(es) and Enhancement(s):

  • Rebase PHP to 8.2.32 for CVE-2026-14355 in 9.8.z (JIRA:AlmaLinux-192622)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:40416
Updated
2026-11-02
OSVALSA-2026:47749 No score

Low: php:8.2 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

  • php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)

Bug Fix(es) and Enhancement(s):

  • Rebase PHP to 8.2.32 for CVE-2026-14355 in 8.10.z (JIRA:AlmaLinux-192626)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:47749
Updated
2026-11-02
OSVALSA-2026:47750 No score

Low: php:7.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

  • php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)

Bug Fix(es) and Enhancement(s):

  • Backport fix for CVE-2026-14355 to PHP 7.4 in 8.10.z (JIRA:AlmaLinux-192629)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:47750
Updated
2026-11-02
OSVALSA-2026:48170 No score

Low: php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

  • php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)

Bug Fix(es) and Enhancement(s):

  • Rebase PHP to 8.3.32 for CVE-2026-14355 CVE-2026-12184 in 10.2.z (JIRA:AlmaLinux-192618)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:48170
Updated
2026-11-02
OSVALSA-2026:48197 No score

Low: php:8.3 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

  • php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)

Bug Fix(es) and Enhancement(s):

  • Rebase PHP to 8.3.32 for CVE-2026-14355 CVE-2026-12184 in 9.8.z (JIRA:AlmaLinux-192620)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:48197
Updated
2026-11-02
OSVALSA-2026:49914 No score

Low: php8.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.

Security Fix(es):

  • php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)

Bug Fix(es) and Enhancement(s):

  • Rebase PHP to 8.4.23 for CVE-2026-14355 in 10.2.z (JIRA:AlmaLinux-192616)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:49914
Updated
2026-11-02
OSVALSA-2026:61259 No score

Low: php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

  • php: ext/openssl: memory corruption in openssl_encrypt with AES-WRAP-PAD (CVE-2026-14355)
  • php: ext-pgsql: PHP: SQL injection via improper backslash escaping (CVE-2026-17543)
  • php: PHP: Denial of Service via circular symbolic links in phar archives (CVE-2026-7260)

Bug Fix(es) and Enhancement(s):

  • Backport fix for CVE-2026-14355 to PHP 8.0 in 9.8.z (JIRA:AlmaLinux-192624)
  • Backport fix for CVE-2026-17543 and CVE-2026-7260 to PHP 8.0 in 9.8.z (JIRA:AlmaLinux-223940)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:61259
Updated
2026-11-02
OSVAZL-92001 No score

CVE-2026-14355 affecting package php for versions less than 8.3.32-1

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

Record
AZL-92001
Updated
2026-11-05
OSVBIT-libphp-2026-14355 No score

ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

Record
BIT-libphp-2026-14355
Updated
2026-11-02
OSVBIT-php-2026-14355 No score

ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

Record
BIT-php-2026-14355
Updated
2026-11-02
OSVBIT-php-min-2026-14355 No score

ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

Record
BIT-php-min-2026-14355
Updated
2026-11-02
OSVCLSA-2026-1790263653 No score

php: Fix of CVE-2026-14355

  • CVE-2026-14355: fix heap buffer overflow in openssl_encrypt() with AES-WRAP-PAD ciphers by reserving room for the RFC 5649 integrity block in php_openssl_cipher_update() (GH-22186)
Record
CLSA-2026-1790263653
Updated
2026-11-02
OSVMGASA-2026-0274 No score

Updated php packages fix a security vulnerability

The updated php packages fix a security issue: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD. (CVE-2026-14355)

Record
MGASA-2026-0274
Updated
2026-11-02
OSVMGASA-2026-0285 No score

Updated php8.4 and php8.5 packages fix security vulnerabilities

The updated php8.4 and php8.5 packages fix several security issues, e.g. Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD. (CVE-2026-14355)

Record
MGASA-2026-0285
Updated
2026-11-02
OSVopenSUSE-SU-2026:11269-1 No score

php8-8.5.8-1.1 on GA media

These are all security issues fixed in the php8-8.5.8-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11269-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21308-1 No score

Security update for php8

This update for php8 fixes the following issues

  • Update to versio 8.4.23
  • CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw (bsc#1270351).
Record
openSUSE-SU-2026:21308-1
Updated
2026-11-02
OSVSUSE-SU-2026:22635-1 No score

Security update for php8

This update for php8 fixes the following issues

  • Update to versio 8.4.23
  • CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw (bsc#1270351).
Record
SUSE-SU-2026:22635-1
Updated
2026-11-02
OSVSUSE-SU-2026:3164-1 No score

Security update for php8

This update for php8 fixes the following issues

  • Update to version 8.3.32
  • CVE-2026-12184: Failure to setup TLS with a remote server can result in a remote DoS (bsc#1270712).
  • CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw (bsc#1270351).
Record
SUSE-SU-2026:3164-1
Updated
2026-11-02
OSVSUSE-SU-2026:3165-1 No score

Security update for php7

This update for php7 fixes the following issue

  • CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw (bsc#1270351).
Record
SUSE-SU-2026:3165-1
Updated
2026-11-02
OSVSUSE-SU-2026:3514-1 No score

Security update for php8

This update for php8 fixes the following issues:

Update to version 8.2.33.

Security issues fixed:

  • CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion (bsc#1273077).
  • CVE-2026-9672: security issues in libgd (bsc#1273078).
  • CVE-2026-17543: improper escaping of backslashes in user-provided parameters allows for trivial SQL injection in ext-pgsql (bsc#1273075).
  • CVE-2026-14355: buffer allocation flaw in the AES-WRAP-PAD algorithm implementation can lead to heap metadata corruption and an application abort (bsc#1270351).
Record
SUSE-SU-2026:3514-1
Updated
2026-11-02
OSVUSN-8564-1 No score

php8.1, php8.3, php8.5 vulnerabilities

It was discovered that PHP incorrectly handled certain TLS setup failures, resulting in a NULL pointer dereference. An attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-12184)

It was discovered that PHP contained a buffer allocation flaw in the OpenSSL extension when using the AES-WRAP-PAD algorithm. An attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-14355)

Record
USN-8564-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
php82
Alpine:v3.22
 before 8.2.33-r0
8.2.33-r0
php83
Alpine:v3.22
 before 8.3.36-r0
8.3.36-r0
php83
Alpine:v3.23
 before 8.3.36-r0
8.3.36-r0
php83
Alpine:v3.24
 before 8.3.32-r0
8.3.32-r0
php84
Alpine:v3.22
 before 8.4.27-r0
8.4.27-r0
php84
Alpine:v3.23
 before 8.4.27-r0
8.4.27-r0
php84
Alpine:v3.24
 before 8.4.23-r0
8.4.23-r0
php85
Alpine:v3.23
 before 8.5.12-r0
8.5.12-r0
php85
Alpine:v3.24
 before 8.5.8-r0
8.5.8-r0
apcu-panel
AlmaLinux:9
 before 5.1.23-1.module_el9.4.0+65+49ff6472
5.1.23-1.module_el9.4.0+65+49ff6472
Show 290 moreShow less
Affected packages
PackageAffectedFixed
php
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-bcmath
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-cli
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-common
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-dba
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-dbg
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-devel
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-embedded
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-enchant
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-ffi
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-fpm
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-gd
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-gmp
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-intl
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-ldap
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-mbstring
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-mysqlnd
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-odbc
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-opcache
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-pdo
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-pecl-apcu
AlmaLinux:9
 before 5.1.23-1.module_el9.4.0+65+49ff6472
5.1.23-1.module_el9.4.0+65+49ff6472
php-pecl-apcu-devel
AlmaLinux:9
 before 5.1.23-1.module_el9.4.0+65+49ff6472
5.1.23-1.module_el9.4.0+65+49ff6472
php-pecl-rrd
AlmaLinux:9
 before 2.0.3-4.module_el9.4.0+65+49ff6472
2.0.3-4.module_el9.4.0+65+49ff6472
php-pecl-xdebug3
AlmaLinux:9
 before 3.2.2-2.module_el9.4.0+65+49ff6472
3.2.2-2.module_el9.4.0+65+49ff6472
php-pecl-zip
AlmaLinux:9
 before 1.22.3-1.module_el9.4.0+65+49ff6472
1.22.3-1.module_el9.4.0+65+49ff6472
php-pgsql
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-process
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-snmp
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-soap
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
php-xml
AlmaLinux:9
 before 8.2.32-1.module_el9.8.0+284+2e0ccc92
8.2.32-1.module_el9.8.0+284+2e0ccc92
apcu-panel
AlmaLinux:8
 before 5.1.23-1.module_el8.10.0+3796+30ed3ef7
5.1.23-1.module_el8.10.0+3796+30ed3ef7
libzip
AlmaLinux:8
 before 1.7.3-1.module_el8.10.0+3796+30ed3ef7
1.7.3-1.module_el8.10.0+3796+30ed3ef7
libzip-devel
AlmaLinux:8
 before 1.7.3-1.module_el8.10.0+3796+30ed3ef7
1.7.3-1.module_el8.10.0+3796+30ed3ef7
libzip-tools
AlmaLinux:8
 before 1.7.3-1.module_el8.10.0+3796+30ed3ef7
1.7.3-1.module_el8.10.0+3796+30ed3ef7
php
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-bcmath
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-cli
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-common
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-dba
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-dbg
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-devel
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-embedded
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-enchant
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-ffi
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-fpm
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-gd
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-gmp
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-intl
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-ldap
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-mbstring
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-mysqlnd
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-odbc
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-opcache
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-pdo
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-pear
AlmaLinux:8
 before 1:1.10.14-1.module_el8.10.0+3796+30ed3ef7
1:1.10.14-1.module_el8.10.0+3796+30ed3ef7
php-pecl-apcu
AlmaLinux:8
 before 5.1.23-1.module_el8.10.0+3796+30ed3ef7
5.1.23-1.module_el8.10.0+3796+30ed3ef7
php-pecl-apcu-devel
AlmaLinux:8
 before 5.1.23-1.module_el8.10.0+3796+30ed3ef7
5.1.23-1.module_el8.10.0+3796+30ed3ef7
php-pecl-rrd
AlmaLinux:8
 before 2.0.3-1.module_el8.10.0+3796+30ed3ef7
2.0.3-1.module_el8.10.0+3796+30ed3ef7
php-pecl-xdebug3
AlmaLinux:8
 before 3.2.2-2.module_el8.10.0+3796+30ed3ef7
3.2.2-2.module_el8.10.0+3796+30ed3ef7
php-pecl-zip
AlmaLinux:8
 before 1.22.3-1.module_el8.10.0+3796+30ed3ef7
1.22.3-1.module_el8.10.0+3796+30ed3ef7
php-pgsql
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-process
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-snmp
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-soap
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
php-xml
AlmaLinux:8
 before 8.2.32-1.module_el8.10.0+4244+2e40d2d0
8.2.32-1.module_el8.10.0+4244+2e40d2d0
apcu-panel
AlmaLinux:8
 before 5.1.18-1.module_el8.6.0+2750+78feabcb
5.1.18-1.module_el8.6.0+2750+78feabcb
libzip
AlmaLinux:8
 before 1.6.1-1.module_el8.6.0+2750+78feabcb
1.6.1-1.module_el8.6.0+2750+78feabcb
libzip
AlmaLinux:8
 before 1.6.1-1.module_el8.6.0+3239+bedf0508
1.6.1-1.module_el8.6.0+3239+bedf0508
libzip
AlmaLinux:8
 before 1.6.1-1.module_el8.10.0+3935+28808425
1.6.1-1.module_el8.10.0+3935+28808425
libzip-devel
AlmaLinux:8
 before 1.6.1-1.module_el8.10.0+3935+28808425
1.6.1-1.module_el8.10.0+3935+28808425
libzip-devel
AlmaLinux:8
 before 1.6.1-1.module_el8.6.0+3239+bedf0508
1.6.1-1.module_el8.6.0+3239+bedf0508
libzip-tools
AlmaLinux:8
 before 1.6.1-1.module_el8.10.0+3935+28808425
1.6.1-1.module_el8.10.0+3935+28808425
libzip-tools
AlmaLinux:8
 before 1.6.1-1.module_el8.6.0+3239+bedf0508
1.6.1-1.module_el8.6.0+3239+bedf0508
libzip-tools
AlmaLinux:8
 before 1.6.1-1.module_el8.6.0+2750+78feabcb
1.6.1-1.module_el8.6.0+2750+78feabcb
php
Azure Linux:3
 before 8.3.32-1
8.3.32-1
php81
Alpaquita:23
 8.1.19-r0 and later None known
php83
Alpaquita:25
 8.3.21-r0 up to 8.3.32-r0
8.3.32-r0
php83
Alpaquita:stream
 8.3.4-r2 up to 8.3.32-r0
8.3.32-r0
libphp
Bitnami
 8.2.0 up to 8.2.32, 8.3.0 up to 8.3.32, 8.4.0 up to 8.4.23, 8.5.0 up to 8.5.8
8.2.328.3.328.4.238.5.8
php
Bitnami
 8.2.0 up to 8.2.32, 8.3.0 up to 8.3.32, 8.4.0 up to 8.4.23, 8.5.0 up to 8.5.8
8.2.328.3.328.4.238.5.8
php-min
Bitnami
 8.2.0 up to 8.2.32, 8.3.0 up to 8.3.32, 8.4.0 up to 8.4.23, 8.5.0 up to 8.5.8
8.2.328.3.328.4.238.5.8
php
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-bcmath
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-cli
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-common
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-dba
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-dbg
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-devel
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-embedded
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-enchant
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-ffi
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-fpm
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-gd
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-gmp
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-intl
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-ldap
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-mbstring
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-mysqlnd
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-odbc
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-opcache
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-pdo
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-pgsql
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-process
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-snmp
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-soap
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php-xml
TuxCare:AlmaLinux:9.6
 before 8.0.30-3.el9_6.tuxcare.els7
8.0.30-3.el9_6.tuxcare.els7
php8.2
Debian:12
 before 8.2.32-1~deb12u1, plus listed versions
8.2.10-18.2.10-28.2.12-18.2.16-18.2.16-2
Show 22 moreShow less
8.2.17-18.2.18-18.2.18-1~deb12u18.2.20-1~deb12u18.2.20-28.2.20-38.2.21-18.2.23-18.2.24-18.2.24-1~deb12u18.2.26-1~deb12u18.2.26-48.2.27-18.2.28-1~deb12u18.2.29-1~deb12u18.2.30-1~deb12u18.2.31-1~deb12u18.2.5-28.2.7-18.2.7-1.18.2.7-1.28.2.7-1~deb12u1
8.2.32-1~deb12u1
php8.4
Debian:13
 before 8.4.23-1~deb13u1, plus listed versions
8.4.11-18.4.16-18.4.16-1~deb13u18.4.20-18.4.21-18.4.21-1~deb13u18.4.22-1
8.4.23-1~deb13u1
php8.4
Debian:14
 before 8.4.23-1, plus listed versions
8.4.11-18.4.16-18.4.16-1~deb13u18.4.20-18.4.21-18.4.21-1~deb13u18.4.22-18.4.23-1~deb13u1
8.4.23-1
php
Mageia:9
 before 8.2.32-1.mga9
8.2.32-1.mga9
php8.4
Mageia:10
 before 8.4.23-1.mga10
8.4.23-1.mga10
php8.5
Mageia:10
 before 8.5.8-1.mga10
8.5.8-1.mga10
php
openEuler:22.03-LTS-SP4
 before 8.0.30-14.oe2203sp4
8.0.30-14.oe2203sp4
php
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 8.3.32-1.oe2403sp1
8.3.32-1.oe2403sp1
php
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 8.3.32-1.oe2403sp3
8.3.32-1.oe2403sp3
php
openEuler:24.03-LTS-SP4
From an advisory covering 2 CVEs
 before 8.3.32-1.oe2403sp4
8.3.32-1.oe2403sp4
php
openEuler:20.03-LTS-SP4
 before 8.0.30-14.oe2003sp4
8.0.30-14.oe2003sp4
php
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-bcmath
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-cli
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-common
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-dba
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-dbg
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-devel
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-embedded
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-enchant
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-ffi
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-fpm
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-gd
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-gmp
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-intl
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-ldap
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-mbstring
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-mysqlnd
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-odbc
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-pdo
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-pdo-dblib
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-pdo-firebird
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-pgsql
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-process
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-snmp
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-soap
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-sodium
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-tidy
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
php-xml
Red Hat:hummingbird:1
 before 0:8.5.8-2.hum1
0:8.5.8-2.hum1
apcu-panel
Red Hat:enterprise_linux:9::appstream
 before 0:5.1.23-1.module+el9.7.0+24111+199d2cc4
0:5.1.23-1.module+el9.7.0+24111+199d2cc4
php
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-bcmath
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-bcmath-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-cli
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-cli-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-common
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-common-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-dba
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-dba-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-dbg
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-dbg-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-devel
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-embedded
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-embedded-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-enchant
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-enchant-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-ffi
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-ffi-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-fpm
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-fpm-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-gd
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-gd-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-gmp
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-gmp-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-intl
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-intl-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-ldap
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-ldap-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-mbstring
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-mbstring-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-mysqlnd
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-mysqlnd-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-odbc
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-odbc-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-opcache
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-opcache-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-pdo
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-pdo-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.2.32-1.module+el9.8.0+24509+ccb2f649
0:8.2.32-1.module+el9.8.0+24509+ccb2f649
php-pecl-apcu
Red Hat:enterprise_linux:9::appstream
 before 0:5.1.23-1.module+el9.7.0+24111+199d2cc4
0:5.1.23-1.module+el9.7.0+24111+199d2cc4
php-pecl-apcu-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:5.1.23-1.module+el9.7.0+24111+199d2cc4
0:5.1.23-1.module+el9.7.0+24111+199d2cc4
php-pecl-apcu-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:5.1.23-1.module+el9.7.0+24111+199d2cc4
0:5.1.23-1.module+el9.7.0+24111+199d2cc4
php-pecl-apcu-devel
Red Hat:enterprise_linux:9::appstream
 before 0:5.1.23-1.module+el9.7.0+24111+199d2cc4
0:5.1.23-1.module+el9.7.0+24111+199d2cc4
php-pecl-rrd
Red Hat:enterprise_linux:9::appstream
 before 0:2.0.3-4.module+el9.7.0+24111+199d2cc4
0:2.0.3-4.module+el9.7.0+24111+199d2cc4
php-pecl-rrd-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:2.0.3-4.module+el9.7.0+24111+199d2cc4
0:2.0.3-4.module+el9.7.0+24111+199d2cc4
php
Rocky Linux:9
 before 0:8.2.32-1.module+el9.8.0+40254+a2d3a842
0:8.2.32-1.module+el9.8.0+40254+a2d3a842
php-pecl-apcu
Rocky Linux:9
 before 0:5.1.23-1.module+el9.7.0+40004+bf50a568
0:5.1.23-1.module+el9.7.0+40004+bf50a568
php-pecl-apcu
Rocky Linux:9
 before 0:5.1.23-1.module+el9.7.0+40005+715283ec
0:5.1.23-1.module+el9.7.0+40005+715283ec
php-pecl-rrd
Rocky Linux:9
 before 0:2.0.3-4.module+el9.7.0+40005+715283ec
0:2.0.3-4.module+el9.7.0+40005+715283ec
php-pecl-rrd
Rocky Linux:9
 before 0:2.0.3-4.module+el9.7.0+40003+454ed3c4
0:2.0.3-4.module+el9.7.0+40003+454ed3c4
php-pecl-rrd
Rocky Linux:9
 before 0:2.0.3-4.module+el9.7.0+40004+bf50a568
0:2.0.3-4.module+el9.7.0+40004+bf50a568
php-pecl-xdebug3
Rocky Linux:9
 before 0:3.2.2-2.module+el9.7.0+40004+bf50a568
0:3.2.2-2.module+el9.7.0+40004+bf50a568
php-pecl-zip
Rocky Linux:9
 before 0:1.22.3-1.module+el9.7.0+40004+bf50a568
0:1.22.3-1.module+el9.7.0+40004+bf50a568
php-pecl-zip
Rocky Linux:9
 before 0:1.22.3-1.module+el9.7.0+40005+715283ec
0:1.22.3-1.module+el9.7.0+40005+715283ec
libzip
Rocky Linux:8
 before 0:1.7.3-1.module+el8.10.0+1911+f499711e
0:1.7.3-1.module+el8.10.0+1911+f499711e
libzip
Rocky Linux:8
 before 0:1.7.3-1.module+el8.10.0+1605+02e07af7
0:1.7.3-1.module+el8.10.0+1605+02e07af7
libzip
Rocky Linux:8
 before 0:1.7.3-1.module+el8.10.0+1596+477f03f8
0:1.7.3-1.module+el8.10.0+1596+477f03f8
php
Rocky Linux:8
 before 0:8.2.32-1.module+el8.10.0+40266+b4834305
0:8.2.32-1.module+el8.10.0+40266+b4834305
php-pear
Rocky Linux:8
 before 1:1.10.14-1.module+el8.10.0+1911+f499711e
1:1.10.14-1.module+el8.10.0+1911+f499711e
php-pear
Rocky Linux:8
 before 1:1.10.14-1.module+el8.10.0+1596+477f03f8
1:1.10.14-1.module+el8.10.0+1596+477f03f8
php-pecl-apcu
Rocky Linux:8
 before 0:5.1.23-1.module+el8.10.0+1911+f499711e
0:5.1.23-1.module+el8.10.0+1911+f499711e
php-pecl-apcu
Rocky Linux:8
 before 0:5.1.23-1.module+el8.10.0+1596+477f03f8
0:5.1.23-1.module+el8.10.0+1596+477f03f8
php-pecl-rrd
Rocky Linux:8
 before 0:2.0.3-1.module+el8.10.0+1596+477f03f8
0:2.0.3-1.module+el8.10.0+1596+477f03f8
php-pecl-rrd
Rocky Linux:8
 before 0:2.0.3-1.module+el8.10.0+1605+02e07af7
0:2.0.3-1.module+el8.10.0+1605+02e07af7
php-pecl-rrd
Rocky Linux:8
 before 0:2.0.3-1.module+el8.10.0+1911+f499711e
0:2.0.3-1.module+el8.10.0+1911+f499711e
php-pecl-xdebug3
Rocky Linux:8
 before 0:3.2.2-2.module+el8.10.0+1911+f499711e
0:3.2.2-2.module+el8.10.0+1911+f499711e
php-pecl-xdebug3
Rocky Linux:8
 before 0:3.2.2-2.module+el8.10.0+1596+477f03f8
0:3.2.2-2.module+el8.10.0+1596+477f03f8
php-pecl-zip
Rocky Linux:8
 before 0:1.22.3-1.module+el8.10.0+1911+f499711e
0:1.22.3-1.module+el8.10.0+1911+f499711e
php-pecl-zip
Rocky Linux:8
 before 0:1.22.3-1.module+el8.10.0+1596+477f03f8
0:1.22.3-1.module+el8.10.0+1596+477f03f8
libzip
Rocky Linux:8
 before 0:1.6.1-1.module+el8.10.0+1912+72767185
0:1.6.1-1.module+el8.10.0+1912+72767185
libzip
Rocky Linux:8
 before 0:1.6.1-1.module+el8.10.0+1604+6558efc7
0:1.6.1-1.module+el8.10.0+1604+6558efc7
php
Rocky Linux:8
 before 0:7.4.33-5.module+el8.10.0+40265+5b373a55
0:7.4.33-5.module+el8.10.0+40265+5b373a55
php-pear
Rocky Linux:8
 before 1:1.10.13-1.module+el8.10.0+1605+02e07af7
1:1.10.13-1.module+el8.10.0+1605+02e07af7
php-pear
Rocky Linux:8
 before 1:1.10.13-1.module+el8.10.0+1604+6558efc7
1:1.10.13-1.module+el8.10.0+1604+6558efc7
php-pear
Rocky Linux:8
 before 1:1.10.13-1.module+el8.10.0+1912+72767185
1:1.10.13-1.module+el8.10.0+1912+72767185
php-pecl-apcu
Rocky Linux:8
 before 0:5.1.18-1.module+el8.10.0+1604+6558efc7
0:5.1.18-1.module+el8.10.0+1604+6558efc7
php-pecl-apcu
Rocky Linux:8
 before 0:5.1.18-1.module+el8.10.0+1912+72767185
0:5.1.18-1.module+el8.10.0+1912+72767185
php-pecl-rrd
Rocky Linux:8
 before 0:2.0.1-1.module+el8.10.0+1912+72767185
0:2.0.1-1.module+el8.10.0+1912+72767185
php-pecl-rrd
Rocky Linux:8
 before 0:2.0.1-1.module+el8.10.0+1604+6558efc7
0:2.0.1-1.module+el8.10.0+1604+6558efc7
php-pecl-rrd
Rocky Linux:8
 before 0:2.0.1-1.module+el8.4.0+414+2e7afcdd
0:2.0.1-1.module+el8.4.0+414+2e7afcdd
php-pecl-xdebug
Rocky Linux:8
 before 0:2.9.5-1.module+el8.10.0+1912+72767185
0:2.9.5-1.module+el8.10.0+1912+72767185
php-pecl-xdebug
Rocky Linux:8
 before 0:2.9.5-1.module+el8.10.0+1604+6558efc7
0:2.9.5-1.module+el8.10.0+1604+6558efc7
php-pecl-zip
Rocky Linux:8
 before 0:1.18.2-1.module+el8.10.0+1604+6558efc7
0:1.18.2-1.module+el8.10.0+1604+6558efc7
php-pecl-zip
Rocky Linux:8
 before 0:1.18.2-1.module+el8.10.0+1912+72767185
0:1.18.2-1.module+el8.10.0+1912+72767185
php
Rocky Linux:10
 before 0:8.3.32-1.el10_2
0:8.3.32-1.el10_2
php
Rocky Linux:9
 before 0:8.3.32-1.module+el9.8.0+40268+95fe8e53
0:8.3.32-1.module+el9.8.0+40268+95fe8e53
php-pecl-redis6
Rocky Linux:9
 before 0:6.1.0-3.module+el9.8.0+40203+35cc8ffc
0:6.1.0-3.module+el9.8.0+40203+35cc8ffc
php-pecl-xdebug3
Rocky Linux:9
 before 0:3.3.1-1.module+el9.7.0+40005+715283ec
0:3.3.1-1.module+el9.7.0+40005+715283ec
php8.4
Rocky Linux:10
 before 0:8.4.23-1.el10_2
0:8.4.23-1.el10_2
php
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:8.0.30-8.el9_8
0:8.0.30-8.el9_8
apache2-mod_php8
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8-embed
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8-fastcgi
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8-fpm
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
apache2-mod_php8
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8-embed
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8-fastcgi
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8-fpm
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
apache2-mod_php8
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 2 CVEs
 before 8.3.32-150700.3.15.1
8.3.32-150700.3.15.1
php8
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 2 CVEs
 before 8.3.32-150700.3.15.1
8.3.32-150700.3.15.1
php8-embed
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 2 CVEs
 before 8.3.32-150700.3.15.1
8.3.32-150700.3.15.1
php8-fastcgi
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 2 CVEs
 before 8.3.32-150700.3.15.1
8.3.32-150700.3.15.1
php8-fpm
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 2 CVEs
 before 8.3.32-150700.3.15.1
8.3.32-150700.3.15.1
php8-test
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 2 CVEs
 before 8.3.32-150700.3.15.1
8.3.32-150700.3.15.1
apache2-mod_php7
SUSE:Linux Enterprise Module for Legacy 15 SP7
 before 7.4.33-150400.4.63.1
7.4.33-150400.4.63.1
php7
SUSE:Linux Enterprise Module for Legacy 15 SP7
 before 7.4.33-150400.4.63.1
7.4.33-150400.4.63.1
apache2-mod_php7
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 7.4.33-150400.4.63.1
7.4.33-150400.4.63.1
php7
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 7.4.33-150400.4.63.1
7.4.33-150400.4.63.1
php7-embed
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 7.4.33-150400.4.63.1
7.4.33-150400.4.63.1
php7-fastcgi
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 7.4.33-150400.4.63.1
7.4.33-150400.4.63.1
php7-fpm
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 7.4.33-150400.4.63.1
7.4.33-150400.4.63.1
php7-test
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 7.4.33-150400.4.63.1
7.4.33-150400.4.63.1
apache2-mod_php8
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 4 CVEs
 before 8.2.33-150600.3.33.1
8.2.33-150600.3.33.1
php8
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 4 CVEs
 before 8.2.33-150600.3.33.1
8.2.33-150600.3.33.1
php8-embed
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 4 CVEs
 before 8.2.33-150600.3.33.1
8.2.33-150600.3.33.1
php8-fastcgi
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 4 CVEs
 before 8.2.33-150600.3.33.1
8.2.33-150600.3.33.1
php8-fpm
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 4 CVEs
 before 8.2.33-150600.3.33.1
8.2.33-150600.3.33.1
php8-test
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 4 CVEs
 before 8.2.33-150600.3.33.1
8.2.33-150600.3.33.1
apache2-mod_php8
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 4 CVEs
 before 8.2.33-150600.3.33.1
8.2.33-150600.3.33.1
php8
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 4 CVEs
 before 8.2.33-150600.3.33.1
8.2.33-150600.3.33.1
php8-embed
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 4 CVEs
 before 8.2.33-150600.3.33.1
8.2.33-150600.3.33.1
php8-fastcgi
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 4 CVEs
 before 8.2.33-150600.3.33.1
8.2.33-150600.3.33.1
php8-fpm
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 4 CVEs
 before 8.2.33-150600.3.33.1
8.2.33-150600.3.33.1
php8-test
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 4 CVEs
 before 8.2.33-150600.3.33.1
8.2.33-150600.3.33.1
php5
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
5.5.3+dfsg-1ubuntu25.5.3+dfsg-1ubuntu35.5.6+dfsg-1ubuntu15.5.6+dfsg-1ubuntu25.5.8+dfsg-2ubuntu1
Show 44 moreShow less
5.5.9+dfsg-1ubuntu15.5.9+dfsg-1ubuntu25.5.9+dfsg-1ubuntu35.5.9+dfsg-1ubuntu45.5.9+dfsg-1ubuntu4.15.5.9+dfsg-1ubuntu4.25.5.9+dfsg-1ubuntu4.35.5.9+dfsg-1ubuntu4.45.5.9+dfsg-1ubuntu4.55.5.9+dfsg-1ubuntu4.65.5.9+dfsg-1ubuntu4.75.5.9+dfsg-1ubuntu4.95.5.9+dfsg-1ubuntu4.115.5.9+dfsg-1ubuntu4.125.5.9+dfsg-1ubuntu4.135.5.9+dfsg-1ubuntu4.145.5.9+dfsg-1ubuntu4.165.5.9+dfsg-1ubuntu4.175.5.9+dfsg-1ubuntu4.195.5.9+dfsg-1ubuntu4.205.5.9+dfsg-1ubuntu4.215.5.9+dfsg-1ubuntu4.225.5.9+dfsg-1ubuntu4.235.5.9+dfsg-1ubuntu4.245.5.9+dfsg-1ubuntu4.255.5.9+dfsg-1ubuntu4.265.5.9+dfsg-1ubuntu4.275.5.9+dfsg-1ubuntu4.295.5.9+dfsg-1ubuntu4.29+esm15.5.9+dfsg-1ubuntu4.29+esm25.5.9+dfsg-1ubuntu4.29+esm35.5.9+dfsg-1ubuntu4.29+esm45.5.9+dfsg-1ubuntu4.29+esm55.5.9+dfsg-1ubuntu4.29+esm65.5.9+dfsg-1ubuntu4.29+esm85.5.9+dfsg-1ubuntu4.29+esm105.5.9+dfsg-1ubuntu4.29+esm115.5.9+dfsg-1ubuntu4.29+esm125.5.9+dfsg-1ubuntu4.29+esm135.5.9+dfsg-1ubuntu4.29+esm145.5.9+dfsg-1ubuntu4.29+esm155.5.9+dfsg-1ubuntu4.29+esm165.5.9+dfsg-1ubuntu4.29+esm175.5.9+dfsg-1ubuntu4.29+esm18
 None known
php7.2
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
7.2.1-1ubuntu27.2.2-1ubuntu17.2.2-1ubuntu27.2.3-1ubuntu17.2.5-0ubuntu0.18.04.1
Show 37 moreShow less
7.2.7-0ubuntu0.18.04.17.2.7-0ubuntu0.18.04.27.2.10-0ubuntu0.18.04.17.2.15-0ubuntu0.18.04.17.2.15-0ubuntu0.18.04.27.2.17-0ubuntu0.18.04.17.2.19-0ubuntu0.18.04.17.2.19-0ubuntu0.18.04.27.2.24-0ubuntu0.18.04.17.2.24-0ubuntu0.18.04.27.2.24-0ubuntu0.18.04.37.2.24-0ubuntu0.18.04.47.2.24-0ubuntu0.18.04.67.2.24-0ubuntu0.18.04.77.2.24-0ubuntu0.18.04.87.2.24-0ubuntu0.18.04.97.2.24-0ubuntu0.18.04.107.2.24-0ubuntu0.18.04.117.2.24-0ubuntu0.18.04.127.2.24-0ubuntu0.18.04.137.2.24-0ubuntu0.18.04.157.2.24-0ubuntu0.18.04.167.2.24-0ubuntu0.18.04.177.2.24-0ubuntu0.18.04.17+esm17.2.24-0ubuntu0.18.04.17+esm27.2.24-0ubuntu0.18.04.17+esm37.2.24-0ubuntu0.18.04.17+esm47.2.24-0ubuntu0.18.04.17+esm57.2.24-0ubuntu0.18.04.17+esm67.2.24-0ubuntu0.18.04.17+esm77.2.24-0ubuntu0.18.04.17+esm87.2.24-0ubuntu0.18.04.17+esm97.2.24-0ubuntu0.18.04.17+esm107.2.24-0ubuntu0.18.04.17+esm117.2.24-0ubuntu0.18.04.17+esm127.2.24-0ubuntu0.18.04.17+esm137.2.24-0ubuntu0.18.04.17+esm14
 None known
php7.4
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
7.4.3-4build17.4.3-4build27.4.3-4ubuntu17.4.3-4ubuntu1.17.4.3-4ubuntu2.2
Show 27 moreShow less
7.4.3-4ubuntu2.47.4.3-4ubuntu2.57.4.3-4ubuntu2.67.4.3-4ubuntu2.77.4.3-4ubuntu2.87.4.3-4ubuntu2.97.4.3-4ubuntu2.107.4.3-4ubuntu2.117.4.3-4ubuntu2.127.4.3-4ubuntu2.137.4.3-4ubuntu2.157.4.3-4ubuntu2.167.4.3-4ubuntu2.177.4.3-4ubuntu2.187.4.3-4ubuntu2.197.4.3-4ubuntu2.207.4.3-4ubuntu2.227.4.3-4ubuntu2.237.4.3-4ubuntu2.247.4.3-4ubuntu2.267.4.3-4ubuntu2.287.4.3-4ubuntu2.297.4.3-4ubuntu2.29+esm17.4.3-4ubuntu2.29+esm27.4.3-4ubuntu2.29+esm37.4.3-4ubuntu2.29+esm47.4.3-4ubuntu2.29+esm5
 None known
php8.1
Ubuntu:22.04:LTS
 before 8.1.2-1ubuntu2.25, plus listed versions
8.1.0~rc4-1ubuntu28.1.0-18.1.2-1ubuntu18.1.2-1ubuntu28.1.2-1ubuntu2.1
Show 20 moreShow less
8.1.2-1ubuntu2.28.1.2-1ubuntu2.38.1.2-1ubuntu2.48.1.2-1ubuntu2.58.1.2-1ubuntu2.68.1.2-1ubuntu2.88.1.2-1ubuntu2.98.1.2-1ubuntu2.108.1.2-1ubuntu2.118.1.2-1ubuntu2.138.1.2-1ubuntu2.148.1.2-1ubuntu2.158.1.2-1ubuntu2.178.1.2-1ubuntu2.188.1.2-1ubuntu2.198.1.2-1ubuntu2.208.1.2-1ubuntu2.218.1.2-1ubuntu2.228.1.2-1ubuntu2.238.1.2-1ubuntu2.24
8.1.2-1ubuntu2.25
php8.3
Ubuntu:24.04:LTS
 before 8.3.6-0ubuntu0.24.04.10, plus listed versions
8.3.0-18.3.0-1ubuntu18.3.4-18.3.4-1build18.3.6-0maysync1
Show 9 moreShow less
8.3.6-0ubuntu0.24.04.18.3.6-0ubuntu0.24.04.28.3.6-0ubuntu0.24.04.38.3.6-0ubuntu0.24.04.48.3.6-0ubuntu0.24.04.58.3.6-0ubuntu0.24.04.68.3.6-0ubuntu0.24.04.78.3.6-0ubuntu0.24.04.88.3.6-0ubuntu0.24.04.9
8.3.6-0ubuntu0.24.04.10
php8.4
Ubuntu:25.10
 All versions, plus listed versions
8.4.5-1ubuntu18.4.8-1ubuntu18.4.11-1ubuntu18.4.11-1ubuntu1.18.4.11-1ubuntu1.2
 None known
php8.5
Ubuntu:26.04:LTS
 before 8.5.4-0ubuntu1.2, plus listed versions
8.5.2-0ubuntu18.5.4-0ubuntu18.5.4-0ubuntu1.1
8.5.4-0ubuntu1.2
php8.1
Ubuntu:22.04:LTS
From an advisory covering 2 CVEs
 before 8.1.2-1ubuntu2.25, plus listed versions
8.1.0~rc4-1ubuntu28.1.0-18.1.2-1ubuntu18.1.2-1ubuntu28.1.2-1ubuntu2.1
Show 20 moreShow less
8.1.2-1ubuntu2.28.1.2-1ubuntu2.38.1.2-1ubuntu2.48.1.2-1ubuntu2.58.1.2-1ubuntu2.68.1.2-1ubuntu2.88.1.2-1ubuntu2.98.1.2-1ubuntu2.108.1.2-1ubuntu2.118.1.2-1ubuntu2.138.1.2-1ubuntu2.148.1.2-1ubuntu2.158.1.2-1ubuntu2.178.1.2-1ubuntu2.188.1.2-1ubuntu2.198.1.2-1ubuntu2.208.1.2-1ubuntu2.218.1.2-1ubuntu2.228.1.2-1ubuntu2.238.1.2-1ubuntu2.24
8.1.2-1ubuntu2.25
php8.3
Ubuntu:24.04:LTS
From an advisory covering 2 CVEs
 before 8.3.6-0ubuntu0.24.04.10, plus listed versions
8.3.0-18.3.0-1ubuntu18.3.4-18.3.4-1build18.3.6-0maysync1
Show 9 moreShow less
8.3.6-0ubuntu0.24.04.18.3.6-0ubuntu0.24.04.28.3.6-0ubuntu0.24.04.38.3.6-0ubuntu0.24.04.48.3.6-0ubuntu0.24.04.58.3.6-0ubuntu0.24.04.68.3.6-0ubuntu0.24.04.78.3.6-0ubuntu0.24.04.88.3.6-0ubuntu0.24.04.9
8.3.6-0ubuntu0.24.04.10
php8.5
Ubuntu:26.04:LTS
From an advisory covering 2 CVEs
 before 8.5.4-0ubuntu1.2, plus listed versions
8.5.2-0ubuntu18.5.4-0ubuntu18.5.4-0ubuntu1.1
8.5.4-0ubuntu1.2
php8
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 8.5.8-1.1
8.5.8-1.1
apache2-mod_php8
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8-embed
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8-fastcgi
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8-fpm
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1
php8-test
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 8.4.23-160000.1.1
8.4.23-160000.1.1

History

History
RecordedChangedSources
affected
factsOSV
affected, aliases, referencesOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-14355 is a medium vulnerability (CVSS 5.6) in Php, published July 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in php82 8.2.33-r0.

References

Show 84 moreShow less
This page doesn't list everything

Left out here: 533 package rows. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open