CVE-2026-6104

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.

Security Fix(es):

• PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258)

• PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735)

• php: NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262)

• php: signed integer overflow in metaphone() (CVE-2026-7568)

• php: denial of service via DOMNode::C14N() (CVE-2026-7263)

• php: global buffer over-read in mb_convert_encoding() with attacker-supplied encoding (CVE-2026-6104)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.

Security Fix(es):

• PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258)
• PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735)
• php: NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262)
• php: signed integer overflow in metaphone() (CVE-2026-7568)
• php: denial of service via DOMNode::C14N() (CVE-2026-7263)
• php: global buffer over-read in mb_convert_encoding() with attacker-supplied encoding (CVE-2026-6104)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.

These are all security issues fixed in the php8-8.5.6-1.1 package on the GA media of openSUSE Tumbleweed.

This update for php8 fixes the following issues

• CVE-2025-14179: improper handling of NULL bytes by the PDO Firebird driver when preparing SQL queries can lead to SQL injection (bsc#1264778).
• CVE-2026-6104: out-of-bounds read when processing an encoding name containing an embedded NULL byte in mb_convert_encoding() can lead to information disclosure and denial of service (bsc#1264777).
• CVE-2026-6722: use-after-free in SOAP using Apache map can lead to remote code execution (bsc#1264776).
• CVE-2026-6735: improper validation of the request URI within the PHP-FPM status page can lead to XSS (bsc#1264775).
• CVE-2026-7258: signed char values passed to ctype functions like isxdigit can lead to OOB access and denial of service (bsc#1264774).
• CVE-2026-7259: NULL pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() can lead to a denial of service (bsc#1264773).
• CVE-2026-7261: use-after-free due to incorrectly handled persistence of handler objects when SOAP_PERSISTENCE_SESSION is configured can lead to memory corruption, information disclosure and process crashes (bsc#1264772).
• CVE-2026-7262: NULL pointer dereference caused by mistake in the SOAP decoding process when a typemap is configured can lead to a denial of service (bsc#1264771).
• CVE-2026-7263: incorrect processing of XML data in the DOMNode: C14N() method can lead to an infinite loop and a denial of service (bsc#1264770).
• CVE-2026-7568: integer overflow in the metaphone function can lead to undefined behavior and affect the availability of the PHPprocess (bsc#1264769).

Other updates:

• Updated to 8.4.21.

This update for php8 fixes the following issues

• CVE-2025-14179: improper handling of NULL bytes by the PDO Firebird driver when preparing SQL queries can lead to SQL injection (bsc#1264778).
• CVE-2026-6104: out-of-bounds read when processing an encoding name containing an embedded NULL byte in mb_convert_encoding() can lead to information disclosure and denial of service (bsc#1264777).
• CVE-2026-6722: use-after-free in SOAP using Apache map can lead to remote code execution (bsc#1264776).
• CVE-2026-6735: improper validation of the request URI within the PHP-FPM status page can lead to XSS (bsc#1264775).
• CVE-2026-7258: signed char values passed to ctype functions like isxdigit can lead to OOB access and denial of service (bsc#1264774).
• CVE-2026-7259: NULL pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() can lead to a denial of service (bsc#1264773).
• CVE-2026-7261: use-after-free due to incorrectly handled persistence of handler objects when SOAP_PERSISTENCE_SESSION is configured can lead to memory corruption, information disclosure and process crashes (bsc#1264772).
• CVE-2026-7262: NULL pointer dereference caused by mistake in the SOAP decoding process when a typemap is configured can lead to a denial of service (bsc#1264771).
• CVE-2026-7263: incorrect processing of XML data in the DOMNode: C14N() method can lead to an infinite loop and a denial of service (bsc#1264770).
• CVE-2026-7568: integer overflow in the metaphone function can lead to undefined behavior and affect the availability of the PHPprocess (bsc#1264769).

Other updates:

• Updated to 8.4.21.