{"id":"CVE-2026-12184","aliases":["ALSA-2026:48170","ALSA-2026:48197","BELL-CVE-2026-12184","DEBIAN-CVE-2026-12184","OESA-2026-3049","OESA-2026-3050","OESA-2026-3051","SUSE-SU-2026:22635-1","SUSE-SU-2026:3164-1","UBUNTU-CVE-2026-12184","USN-8564-1","openSUSE-SU-2026:11269-1","openSUSE-SU-2026:21308-1"],"status":"published","title":"Low: php security, bug fix, and enhancement update","description":"PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.  \n\nSecurity Fix(es):  \n\n  * php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Rebase PHP to 8.3.32 for CVE-2026-14355 CVE-2026-12184 in 10.2.z (JIRA:AlmaLinux-192618)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-07-02T09:57:20.354061Z","modified":"2026-10-29T11:32:22Z","fixes":[{"ecosystem":"Alpaquita:25","package":"php83","fixed_in":["8.3.32-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"php83","fixed_in":["8.3.32-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"php8.4","fixed_in":["8.4.21-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"php8.4","fixed_in":["8.4.21-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"php8.5","fixed_in":["8.5.4-0ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-ffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"apcu-panel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.23-1.module_el9.6.0+151+5f31e576"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-ffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-pecl-apcu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.23-1.module_el9.6.0+151+5f31e576"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-pecl-apcu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.23-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-pecl-apcu-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.23-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-pecl-apcu-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.23-1.module_el9.6.0+151+5f31e576"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-pecl-redis6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0-3.module_el9.8.0+257+89d727f2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-pecl-rrd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-4.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-pecl-rrd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-4.module_el9.6.0+151+5f31e576"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-pecl-xdebug3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-1.module_el9.6.0+151+5f31e576"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-pecl-xdebug3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-pecl-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-1.module_el9.6.0+151+5f31e576"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-pecl-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"php-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.module_el9.8.0+287+a9a5bb73"}]}],"bundled":2},{"source":"osv","ecosystem":"Alpaquita:23","package":"php81","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.19-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"php83","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.3.21-r0"},{"fixed":"8.3.32-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"php83","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.3.4-r2"},{"fixed":"8.3.32-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"php8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1~deb13u1"}]}],"versions":["8.4.11-1","8.4.16-1","8.4.16-1~deb13u1","8.4.20-1"]},{"source":"osv","ecosystem":"Debian:14","package":"php8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1"}]}],"versions":["8.4.11-1","8.4.16-1","8.4.16-1~deb13u1","8.4.20-1","8.4.21-1~deb13u1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-1.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"apache2-mod_php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.23-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.23-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"php8-embed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.23-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"php8-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.23-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"php8-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.23-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"apache2-mod_php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.23-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.23-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"php8-embed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.23-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"php8-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.23-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"php8-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.23-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"apache2-mod_php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-150700.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-150700.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"php8-embed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-150700.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"php8-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-150700.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"php8-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-150700.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"php8-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.32-150700.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"php8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.5-1ubuntu1","8.4.8-1ubuntu1","8.4.11-1ubuntu1","8.4.11-1ubuntu1.1","8.4.11-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"php8.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.4-0ubuntu1.2"}]}],"versions":["8.5.2-0ubuntu1","8.5.4-0ubuntu1","8.5.4-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"php8.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.2-1ubuntu2.25"}]}],"versions":["8.1.0~rc4-1ubuntu2","8.1.0-1","8.1.2-1ubuntu1","8.1.2-1ubuntu2","8.1.2-1ubuntu2.1","8.1.2-1ubuntu2.2","8.1.2-1ubuntu2.3","8.1.2-1ubuntu2.4","8.1.2-1ubuntu2.5","8.1.2-1ubuntu2.6","8.1.2-1ubuntu2.8","8.1.2-1ubuntu2.9","8.1.2-1ubuntu2.10","8.1.2-1ubuntu2.11","8.1.2-1ubuntu2.13","8.1.2-1ubuntu2.14","8.1.2-1ubuntu2.15","8.1.2-1ubuntu2.17","8.1.2-1ubuntu2.18","8.1.2-1ubuntu2.19","8.1.2-1ubuntu2.20","8.1.2-1ubuntu2.21","8.1.2-1ubuntu2.22","8.1.2-1ubuntu2.23","8.1.2-1ubuntu2.24"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"php8.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.6-0ubuntu0.24.04.10"}]}],"versions":["8.3.0-1","8.3.0-1ubuntu1","8.3.4-1","8.3.4-1build1","8.3.6-0maysync1","8.3.6-0ubuntu0.24.04.1","8.3.6-0ubuntu0.24.04.2","8.3.6-0ubuntu0.24.04.3","8.3.6-0ubuntu0.24.04.4","8.3.6-0ubuntu0.24.04.5","8.3.6-0ubuntu0.24.04.6","8.3.6-0ubuntu0.24.04.7","8.3.6-0ubuntu0.24.04.8","8.3.6-0ubuntu0.24.04.9"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"php8.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.4-0ubuntu1.2"}]}],"versions":["8.5.2-0ubuntu1","8.5.4-0ubuntu1","8.5.4-0ubuntu1.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.8-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"apache2-mod_php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.23-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.23-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"php8-embed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.23-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"php8-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.23-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"php8-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.23-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"php8-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.23-160000.1.1"}]}],"bundled":2}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:48170","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14355","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-48170.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48197","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-48197.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-12184","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-12184","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3049","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12184","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14355","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3050","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3051","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622635-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1270351","tags":["report"]},{"url":"https://bugzilla.suse.com/1270712","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14355","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263164-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-12184","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12184","tags":["report"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-mhmq-mmqj-2v39","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8564-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-14355","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"osv":[{"id":"OESA-2026-3049","title":"php security update","description":"PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.\r\n\r\nSecurity Fix(es):\n\n(CVE-2026-12184)\n\nIn PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.(CVE-2026-14355)","status":"published","published":"2026-07-19T11:11:56Z","modified":"2026-08-18T01:21:20.138779292Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3050","title":"php security update","description":"PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.\r\n\r\nSecurity Fix(es):\n\n(CVE-2026-12184)\n\nIn PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.(CVE-2026-14355)","status":"published","published":"2026-07-19T11:11:56Z","modified":"2026-08-18T01:21:20.244535409Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3051","title":"php security update","description":"PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.\r\n\r\nSecurity Fix(es):\n\n(CVE-2026-12184)\n\nIn PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.(CVE-2026-14355)","status":"published","published":"2026-07-19T11:11:56Z","modified":"2026-08-18T01:21:20.264783633Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"ALSA-2026:48170","title":"Low: php security, bug fix, and enhancement update","description":"PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.  \n\nSecurity Fix(es):  \n\n  * php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Rebase PHP to 8.3.32 for CVE-2026-14355 CVE-2026-12184 in 10.2.z (JIRA:AlmaLinux-192618)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-29T00:00:00Z","modified":"2026-10-29T11:30:33.702751933Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:48197","title":"Low: php:8.3 security, bug fix, and enhancement update","description":"PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.  \n\nSecurity Fix(es):  \n\n  * php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Rebase PHP to 8.3.32 for CVE-2026-14355 CVE-2026-12184 in 9.8.z (JIRA:AlmaLinux-192620)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-29T00:00:00Z","modified":"2026-10-29T11:32:22.896818466Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"BELL-CVE-2026-12184","status":"published","published":"2026-07-02T09:57:20.354061Z","modified":"2026-07-09T07:15:04.935400491Z","updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"DEBIAN-CVE-2026-12184","status":"published","published":"2026-07-03T10:48:27.183634107Z","modified":"2026-07-03T11:00:08.409939958Z","updated_at":"2026-11-02T15:45:51.374409Z"},{"id":"openSUSE-SU-2026:11269-1","title":"php8-8.5.8-1.1 on GA media","description":"These are all security issues fixed in the php8-8.5.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-14T00:00:00Z","modified":"2026-07-15T10:00:15.742566691Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21308-1","title":"Security update for php8","description":"This update for php8 fixes the following issues\n\n- Update to versio 8.4.23\n- CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw (bsc#1270351).\n","status":"published","published":"2026-07-12T13:02:01Z","modified":"2026-07-13T12:30:05.005619532Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22635-1","title":"Security update for php8","description":"This update for php8 fixes the following issues\n\n- Update to versio 8.4.23\n- CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw (bsc#1270351).\n","status":"published","published":"2026-07-12T13:02:50Z","modified":"2026-07-17T18:24:03.945832466Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:3164-1","title":"Security update for php8","description":"This update for php8 fixes the following issues\n\n- Update to version 8.3.32\n- CVE-2026-12184: Failure to setup TLS with a remote server can result in a remote DoS (bsc#1270712).\n- CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw (bsc#1270351).\n","status":"published","published":"2026-07-21T14:54:31Z","modified":"2026-07-22T09:30:06.100016551Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"UBUNTU-CVE-2026-12184","description":"PHP: Failure to setup TLS with a remote server can result in a remote DoS","status":"published","published":"2026-07-03T00:00:00Z","modified":"2026-07-21T13:08:13.762034914Z","updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"USN-8564-1","title":"php8.1, php8.3, php8.5 vulnerabilities","description":"It was discovered that PHP incorrectly handled certain TLS setup failures,\nresulting in a NULL pointer dereference. An attacker could possibly use\nthis issue to cause PHP to crash, resulting in a denial of service. This\nissue only affected Ubuntu 26.04 LTS. (CVE-2026-12184)\n\nIt was discovered that PHP contained a buffer allocation flaw in the\nOpenSSL extension when using the AES-WRAP-PAD algorithm. An attacker could\nuse this issue to cause PHP to crash, resulting in a denial of service, or\npossibly execute arbitrary code. (CVE-2026-14355)","status":"published","published":"2026-07-20T12:52:37Z","modified":"2026-07-21T13:20:13.406607425Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}