CVE-2026-17545
PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.
- Record
CVE-2026-17545- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H - Weakness
- CWE-67
- Updated
- 2026-11-02
EUVDEUVD-2026-87329
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.
- Record
EUVD-2026-87329- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H - Updated
- 2026-11-02
NVD
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.
- Record
CVE-2026-17545- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-67
- Updated
- 2026-11-02
OSVBELL-CVE-2026-17545
CVE-2026-17545 does not affect BellSoft software
- Record
BELL-CVE-2026-17545- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:70720
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:70720- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-17545
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.
- Record
UBUNTU-CVE-2026-17545- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVAZL-105141 No score
CVE-2026-17545 affecting package php 8.3.33-1
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.
- Record
AZL-105141- Updated
- 2026-11-02
OSVBIT-libphp-2026-17545 No score
PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.
- Record
BIT-libphp-2026-17545- Updated
- 2026-11-02
OSVBIT-php-2026-17545 No score
PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.
- Record
BIT-php-2026-17545- Updated
- 2026-11-02
OSVBIT-php-min-2026-17545 No score
PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.
- Record
BIT-php-min-2026-17545- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11901-1 No score
php8-8.5.11-1.1 on GA media
These are all security issues fixed in the php8-8.5.11-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11901-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpAzure Linux:3 |
through 8.3.33-1 | None known |
libphpBitnami |
8.2.0 up to 8.2.34, 8.3.0 up to 8.3.35, 8.4.0 up to 8.4.26, 8.5.0 up to 8.5.11 | 8.2.348.3.358.4.268.5.11 |
phpBitnami |
8.2.0 up to 8.2.34, 8.3.0 up to 8.3.35, 8.4.0 up to 8.4.26, 8.5.0 up to 8.5.11 | 8.2.348.3.358.4.268.5.11 |
php-minBitnami |
8.2.0 up to 8.2.34, 8.3.0 up to 8.3.35, 8.4.0 up to 8.4.26, 8.5.0 up to 8.5.11 | 8.2.348.3.358.4.268.5.11 |
phpRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-bcmathRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-cliRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-commonRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-dbaRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-dbgRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
Show 30 moreShow less
| Package | Affected | Fixed |
|---|---|---|
php-develRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-embeddedRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-enchantRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-ffiRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-fpmRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-gdRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-gmpRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-intlRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-ldapRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-mbstringRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-mysqlndRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-odbcRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-pdoRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-pdo-dblibRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-pdo-firebirdRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-pgsqlRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-processRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-snmpRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-soapRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-sodiumRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-tidyRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php-xmlRed Hat:hummingbird:1 From an advisory covering 11 CVEs |
before 0:8.5.11-2.hum1 | 0:8.5.11-2.hum1 |
php5Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 5.5.3+dfsg-1ubuntu25.5.3+dfsg-1ubuntu35.5.6+dfsg-1ubuntu15.5.6+dfsg-1ubuntu25.5.8+dfsg-2ubuntu1 Show 44 moreShow less5.5.9+dfsg-1ubuntu15.5.9+dfsg-1ubuntu25.5.9+dfsg-1ubuntu35.5.9+dfsg-1ubuntu45.5.9+dfsg-1ubuntu4.15.5.9+dfsg-1ubuntu4.25.5.9+dfsg-1ubuntu4.35.5.9+dfsg-1ubuntu4.45.5.9+dfsg-1ubuntu4.55.5.9+dfsg-1ubuntu4.65.5.9+dfsg-1ubuntu4.75.5.9+dfsg-1ubuntu4.95.5.9+dfsg-1ubuntu4.115.5.9+dfsg-1ubuntu4.125.5.9+dfsg-1ubuntu4.135.5.9+dfsg-1ubuntu4.145.5.9+dfsg-1ubuntu4.165.5.9+dfsg-1ubuntu4.175.5.9+dfsg-1ubuntu4.195.5.9+dfsg-1ubuntu4.205.5.9+dfsg-1ubuntu4.215.5.9+dfsg-1ubuntu4.225.5.9+dfsg-1ubuntu4.235.5.9+dfsg-1ubuntu4.245.5.9+dfsg-1ubuntu4.255.5.9+dfsg-1ubuntu4.265.5.9+dfsg-1ubuntu4.275.5.9+dfsg-1ubuntu4.295.5.9+dfsg-1ubuntu4.29+esm15.5.9+dfsg-1ubuntu4.29+esm25.5.9+dfsg-1ubuntu4.29+esm35.5.9+dfsg-1ubuntu4.29+esm45.5.9+dfsg-1ubuntu4.29+esm55.5.9+dfsg-1ubuntu4.29+esm65.5.9+dfsg-1ubuntu4.29+esm85.5.9+dfsg-1ubuntu4.29+esm105.5.9+dfsg-1ubuntu4.29+esm115.5.9+dfsg-1ubuntu4.29+esm125.5.9+dfsg-1ubuntu4.29+esm135.5.9+dfsg-1ubuntu4.29+esm145.5.9+dfsg-1ubuntu4.29+esm155.5.9+dfsg-1ubuntu4.29+esm165.5.9+dfsg-1ubuntu4.29+esm175.5.9+dfsg-1ubuntu4.29+esm18 |
None known |
php7.0Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 7.0.1-57.0.1-67.0.2-17.0.2-37.0.2-4 Show 45 moreShow less7.0.2-57.0.3-27.0.3-37.0.3-9ubuntu17.0.4-5ubuntu17.0.4-5ubuntu27.0.4-7ubuntu17.0.4-7ubuntu27.0.4-7ubuntu2.17.0.8-0ubuntu0.16.04.17.0.8-0ubuntu0.16.04.27.0.8-0ubuntu0.16.04.37.0.13-0ubuntu0.16.04.17.0.15-0ubuntu0.16.04.17.0.15-0ubuntu0.16.04.27.0.15-0ubuntu0.16.04.47.0.18-0ubuntu0.16.04.17.0.22-0ubuntu0.16.04.17.0.25-0ubuntu0.16.04.17.0.28-0ubuntu0.16.04.17.0.30-0ubuntu0.16.04.17.0.32-0ubuntu0.16.04.17.0.33-0ubuntu0.16.04.17.0.33-0ubuntu0.16.04.27.0.33-0ubuntu0.16.04.37.0.33-0ubuntu0.16.04.47.0.33-0ubuntu0.16.04.57.0.33-0ubuntu0.16.04.67.0.33-0ubuntu0.16.04.77.0.33-0ubuntu0.16.04.97.0.33-0ubuntu0.16.04.117.0.33-0ubuntu0.16.04.127.0.33-0ubuntu0.16.04.147.0.33-0ubuntu0.16.04.157.0.33-0ubuntu0.16.04.167.0.33-0ubuntu0.16.04.16+esm17.0.33-0ubuntu0.16.04.16+esm27.0.33-0ubuntu0.16.04.16+esm37.0.33-0ubuntu0.16.04.16+esm47.0.33-0ubuntu0.16.04.16+esm57.0.33-0ubuntu0.16.04.16+esm67.0.33-0ubuntu0.16.04.16+esm77.0.33-0ubuntu0.16.04.16+esm87.0.33-0ubuntu0.16.04.16+esm97.0.33-0ubuntu0.16.04.16+esm10 |
None known |
php7.2Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 7.2.1-1ubuntu27.2.2-1ubuntu17.2.2-1ubuntu27.2.3-1ubuntu17.2.5-0ubuntu0.18.04.1 Show 37 moreShow less7.2.7-0ubuntu0.18.04.17.2.7-0ubuntu0.18.04.27.2.10-0ubuntu0.18.04.17.2.15-0ubuntu0.18.04.17.2.15-0ubuntu0.18.04.27.2.17-0ubuntu0.18.04.17.2.19-0ubuntu0.18.04.17.2.19-0ubuntu0.18.04.27.2.24-0ubuntu0.18.04.17.2.24-0ubuntu0.18.04.27.2.24-0ubuntu0.18.04.37.2.24-0ubuntu0.18.04.47.2.24-0ubuntu0.18.04.67.2.24-0ubuntu0.18.04.77.2.24-0ubuntu0.18.04.87.2.24-0ubuntu0.18.04.97.2.24-0ubuntu0.18.04.107.2.24-0ubuntu0.18.04.117.2.24-0ubuntu0.18.04.127.2.24-0ubuntu0.18.04.137.2.24-0ubuntu0.18.04.157.2.24-0ubuntu0.18.04.167.2.24-0ubuntu0.18.04.177.2.24-0ubuntu0.18.04.17+esm17.2.24-0ubuntu0.18.04.17+esm27.2.24-0ubuntu0.18.04.17+esm37.2.24-0ubuntu0.18.04.17+esm47.2.24-0ubuntu0.18.04.17+esm57.2.24-0ubuntu0.18.04.17+esm67.2.24-0ubuntu0.18.04.17+esm77.2.24-0ubuntu0.18.04.17+esm87.2.24-0ubuntu0.18.04.17+esm97.2.24-0ubuntu0.18.04.17+esm107.2.24-0ubuntu0.18.04.17+esm117.2.24-0ubuntu0.18.04.17+esm127.2.24-0ubuntu0.18.04.17+esm137.2.24-0ubuntu0.18.04.17+esm14 |
None known |
php7.4Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 7.4.3-4build17.4.3-4build27.4.3-4ubuntu17.4.3-4ubuntu1.17.4.3-4ubuntu2.2 Show 27 moreShow less7.4.3-4ubuntu2.47.4.3-4ubuntu2.57.4.3-4ubuntu2.67.4.3-4ubuntu2.77.4.3-4ubuntu2.87.4.3-4ubuntu2.97.4.3-4ubuntu2.107.4.3-4ubuntu2.117.4.3-4ubuntu2.127.4.3-4ubuntu2.137.4.3-4ubuntu2.157.4.3-4ubuntu2.167.4.3-4ubuntu2.177.4.3-4ubuntu2.187.4.3-4ubuntu2.197.4.3-4ubuntu2.207.4.3-4ubuntu2.227.4.3-4ubuntu2.237.4.3-4ubuntu2.247.4.3-4ubuntu2.267.4.3-4ubuntu2.287.4.3-4ubuntu2.297.4.3-4ubuntu2.29+esm17.4.3-4ubuntu2.29+esm27.4.3-4ubuntu2.29+esm37.4.3-4ubuntu2.29+esm47.4.3-4ubuntu2.29+esm5 |
None known |
php8.1Ubuntu:22.04:LTS |
All versions, plus listed versions 8.1.0~rc4-1ubuntu28.1.0-18.1.2-1ubuntu18.1.2-1ubuntu28.1.2-1ubuntu2.1 Show 24 moreShow less8.1.2-1ubuntu2.28.1.2-1ubuntu2.38.1.2-1ubuntu2.48.1.2-1ubuntu2.58.1.2-1ubuntu2.68.1.2-1ubuntu2.88.1.2-1ubuntu2.98.1.2-1ubuntu2.108.1.2-1ubuntu2.118.1.2-1ubuntu2.138.1.2-1ubuntu2.148.1.2-1ubuntu2.158.1.2-1ubuntu2.178.1.2-1ubuntu2.188.1.2-1ubuntu2.198.1.2-1ubuntu2.208.1.2-1ubuntu2.218.1.2-1ubuntu2.228.1.2-1ubuntu2.238.1.2-1ubuntu2.248.1.2-1ubuntu2.258.1.2-1ubuntu2.268.1.2-1ubuntu2.278.1.2-1ubuntu2.28 |
None known |
php8.3Ubuntu:24.04:LTS |
All versions, plus listed versions 8.3.0-18.3.0-1ubuntu18.3.4-18.3.4-1build18.3.6-0maysync1 Show 13 moreShow less8.3.6-0ubuntu0.24.04.18.3.6-0ubuntu0.24.04.28.3.6-0ubuntu0.24.04.38.3.6-0ubuntu0.24.04.48.3.6-0ubuntu0.24.04.58.3.6-0ubuntu0.24.04.68.3.6-0ubuntu0.24.04.78.3.6-0ubuntu0.24.04.88.3.6-0ubuntu0.24.04.98.3.6-0ubuntu0.24.04.108.3.6-0ubuntu0.24.04.118.3.6-0ubuntu0.24.04.128.3.6-0ubuntu0.24.04.13 |
None known |
php8.5Ubuntu:26.04:LTS |
All versions, plus listed versions 8.5.2-0ubuntu18.5.4-0ubuntu18.5.4-0ubuntu1.18.5.4-0ubuntu1.28.5.4-0ubuntu1.38.5.4-0ubuntu1.48.5.4-0ubuntu1.5 |
None known |
php8openSUSE:Tumbleweed From an advisory covering 11 CVEs |
before 8.5.11-1.1 | 8.5.11-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-17545 is a medium vulnerability (CVSS 6.9) in Php, published September 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in libphp 8.2.34.
References
github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp
nvd.nist.gov/vuln/detail/CVE-2026-17545
docs.bell-sw.com/security/cves/CVE-2026-17545
access.redhat.com/errata/RHSA-2026:70720
images.redhat.com
Show 67 moreShow less
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70720.json
bugzilla.redhat.com/show_bug.cgi?id=2541655
cve.org/CVERecord?id=CVE-2025-1218
ubuntu.com/security/CVE-2026-17545
suse.com/security/cve/CVE-2025-1218
Left out here: 12 versions. The JSON record has them.