{"id":"CVE-2026-17544","aliases":["ALPINE-CVE-2026-17544","ALSA-2026:56969","BELL-CVE-2026-17544","BIT-libphp-2026-17544","BIT-php-2026-17544","BIT-php-min-2026-17544","DEBIAN-CVE-2026-17544","EUVD-2026-51091","MGASA-2026-0329","MGASA-2026-0330","RHSA-2026:47200","RHSA-2026:56969","RLSA-2026:56969","SUSE-SU-2026:23121-1","SUSE-SU-2026:23144-1","SUSE-SU-2026:3509-1","UBUNTU-CVE-2026-17544","USN-8743-1","openSUSE-SU-2026:11418-1","openSUSE-SU-2026:21532-1"],"status":"published","title":"Out-of-bounds write in bccomp() via crafted operand and scale","description":"Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.","severity":{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00418,"percentile":0.3637,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-787"],"published":"2026-07-30T11:22:24Z","modified":"2026-11-04T23:13:33Z","exploits":[{"source":"pocgithub","id":"Boreas37/CVE-2026-17544-PoC","title":"Boreas37/CVE-2026-17544-PoC","date":"2026-08-12","url":"https://github.com/Boreas37/CVE-2026-17544-PoC"},{"source":"pocgithub","id":"r2qa/CVE-2026-17544","title":"r2qa/CVE-2026-17544","date":"2026-08-15","url":"https://github.com/r2qa/CVE-2026-17544"}],"fixes":[{"ecosystem":"Alpine:v3.22","package":"php84","fixed_in":["8.4.27-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"php84","fixed_in":["8.4.27-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"php84","fixed_in":["8.4.24-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"php85","fixed_in":["8.5.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"php85","fixed_in":["8.5.9-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"libphp","fixed_in":["8.4.24","8.5.9"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"php","fixed_in":["8.4.24","8.5.9"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"php-min","fixed_in":["8.4.24","8.5.9"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"php8.4","fixed_in":["8.4.24-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"php8.4","fixed_in":["8.4.24-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"php8.5","fixed_in":["8.5.4-0ubuntu1.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"php84","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.27-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"php84","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.27-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"php84","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"php85","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"php85","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.9-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-ffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Bitnami","package":"libphp","ranges":[{"type":"SEMVER","events":[{"introduced":"8.4.0"},{"fixed":"8.4.24"},{"introduced":"8.5.0"},{"fixed":"8.5.9"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"php","ranges":[{"type":"SEMVER","events":[{"introduced":"8.4.0"},{"fixed":"8.4.24"},{"introduced":"8.5.0"},{"fixed":"8.5.9"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"php-min","ranges":[{"type":"SEMVER","events":[{"introduced":"8.4.0"},{"fixed":"8.4.24"},{"introduced":"8.5.0"},{"fixed":"8.5.9"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"php8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1~deb13u1"}]}],"versions":["8.4.11-1","8.4.16-1","8.4.16-1~deb13u1","8.4.20-1","8.4.21-1","8.4.21-1~deb13u1","8.4.22-1","8.4.23-1","8.4.23-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"php8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1"}]}],"versions":["8.4.11-1","8.4.16-1","8.4.16-1~deb13u1","8.4.20-1","8.4.21-1","8.4.21-1~deb13u1","8.4.22-1","8.4.23-1","8.4.23-1~deb13u1","8.4.24-1~deb13u1"]},{"source":"osv","ecosystem":"Mageia:10","package":"php8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-1.1.mga10"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:10","package":"php8.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.9-1.mga10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-ffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-pdo-dblib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-pdo-firebird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-sodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"php-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.9-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-bcmath-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-cli-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-dba-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-dbg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-embedded-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-enchant-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-ffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-ffi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-fpm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-gd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-gmp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-intl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-mbstring-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-mysqlnd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-odbc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-opcache-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-pdo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-process-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-snmp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-soap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-xml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"php8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.24-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"apache2-mod_php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"php8-embed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"php8-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"php8-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"apache2-mod_php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"php8-embed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"php8-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"php8-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"apache2-mod_php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"php8-embed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"php8-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"php8-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"apache2-mod_php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"php8-embed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"php8-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"php8-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"apache2-mod_php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.33-150700.3.18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.33-150700.3.18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"php8-embed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.33-150700.3.18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"php8-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.33-150700.3.18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"php8-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.33-150700.3.18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"php8-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.33-150700.3.18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"php8.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.4-0ubuntu1.3"}]}],"versions":["8.5.2-0ubuntu1","8.5.4-0ubuntu1","8.5.4-0ubuntu1.1","8.5.4-0ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"php8.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.2-1ubuntu2.26"}]}],"versions":["8.1.0~rc4-1ubuntu2","8.1.0-1","8.1.2-1ubuntu1","8.1.2-1ubuntu2","8.1.2-1ubuntu2.1","8.1.2-1ubuntu2.2","8.1.2-1ubuntu2.3","8.1.2-1ubuntu2.4","8.1.2-1ubuntu2.5","8.1.2-1ubuntu2.6","8.1.2-1ubuntu2.8","8.1.2-1ubuntu2.9","8.1.2-1ubuntu2.10","8.1.2-1ubuntu2.11","8.1.2-1ubuntu2.13","8.1.2-1ubuntu2.14","8.1.2-1ubuntu2.15","8.1.2-1ubuntu2.17","8.1.2-1ubuntu2.18","8.1.2-1ubuntu2.19","8.1.2-1ubuntu2.20","8.1.2-1ubuntu2.21","8.1.2-1ubuntu2.22","8.1.2-1ubuntu2.23","8.1.2-1ubuntu2.24","8.1.2-1ubuntu2.25"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"php8.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.6-0ubuntu0.24.04.11"}]}],"versions":["8.3.0-1","8.3.0-1ubuntu1","8.3.4-1","8.3.4-1build1","8.3.6-0maysync1","8.3.6-0ubuntu0.24.04.1","8.3.6-0ubuntu0.24.04.2","8.3.6-0ubuntu0.24.04.3","8.3.6-0ubuntu0.24.04.4","8.3.6-0ubuntu0.24.04.5","8.3.6-0ubuntu0.24.04.6","8.3.6-0ubuntu0.24.04.7","8.3.6-0ubuntu0.24.04.8","8.3.6-0ubuntu0.24.04.9","8.3.6-0ubuntu0.24.04.10"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"php8.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.4-0ubuntu1.3"}]}],"versions":["8.5.2-0ubuntu1","8.5.4-0ubuntu1","8.5.4-0ubuntu1.1","8.5.4-0ubuntu1.2"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.9-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"apache2-mod_php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"php8-embed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"php8-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"php8-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"php8-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.24-160000.1.1"}]}],"bundled":4}],"products":[{"vendor":"php","product":"php"},{"vendor":"php group","product":"php"}],"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-x692-q9x7-8c3f","tags":["vendor-advisory","Vendor Advisory","advisory","article","report"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-17544","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:56969","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-17543","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-17544","tags":["report"]},{"url":"https://bugzilla.redhat.com/2509254","tags":["report"]},{"url":"https://bugzilla.redhat.com/2509256","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-56969.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-17544","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17544","tags":["web","advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-17544","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0329.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36037","tags":["report"]},{"url":"https://www.php.net/ChangeLog-8.php#8.4.24","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2026-0330.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36036","tags":["report"]},{"url":"https://www.php.net/ChangeLog-8.php#8.5.9","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47200","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-7260","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6722","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47200.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468560","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6722","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6722","tags":["advisory"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509255","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7260","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7260","tags":["advisory"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509254","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-17543","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17543","tags":["advisory"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-7qpv-r5mr-78m4","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509256","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-17544","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-223949","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56969.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:56969","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623121-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273075","tags":["report"]},{"url":"https://bugzilla.suse.com/1273076","tags":["report"]},{"url":"https://bugzilla.suse.com/1273077","tags":["report"]},{"url":"https://bugzilla.suse.com/1273078","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9672","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623144-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263509-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-17544","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8743-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-7260","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-17543","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-17544","title":"Out-of-bounds write in bccomp() via crafted operand and scale","description":"Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.","status":"published","published":"2026-07-30T11:22:24.023Z","modified":"2026-07-31T03:55:47.261Z","cvss":[{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N","level":"high","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:19:54.84674Z"}],"euvd":[{"id":"EUVD-2026-51091","description":"Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.","status":"published","published":"2026-07-30T11:22:24Z","modified":"2026-07-31T03:55:47Z","cvss":[{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N","level":"high"}],"updated_at":"2026-11-02T18:02:26.773248Z"}],"nvd":[{"id":"CVE-2026-17544","description":"Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.","status":"published","published":"2026-07-30T12:17:27.347Z","modified":"2026-10-23T22:10:00.16Z","cvss":[{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:33.955581Z"}],"osv":[{"id":"ALPINE-CVE-2026-17544","description":"Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.","status":"published","published":"2026-07-30T12:17:27.347Z","modified":"2026-11-03T06:33:01.565834329Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"BELL-CVE-2026-17544","title":"CVE-2026-17544 does not affect BellSoft software","status":"withdrawn","published":"2026-08-01T06:05:21.329341Z","modified":"2026-08-20T07:15:04.294137047Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"DEBIAN-CVE-2026-17544","description":"Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.","status":"published","published":"2026-07-30T12:17:27.347Z","modified":"2026-10-24T09:47:30.037649832Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:52.562592Z"},{"id":"RHSA-2026:47200","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-06T10:13:07Z","modified":"2026-09-22T10:42:49.460871804Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:56969","title":"Red Hat Security Advisory: php8.4 security, bug fix, and enhancement update","status":"published","published":"2026-08-20T10:20:00Z","modified":"2026-09-03T10:12:41Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RLSA-2026:56969","title":"Important: php8.4 security, bug fix, and enhancement update","description":"PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.\n\nSecurity Fix(es):\n\n* php: ext-pgsql: PHP: SQL injection via improper backslash escaping (CVE-2026-17543)\n\n* php: PHP: Arbitrary code execution via out-of-bounds write in bccomp() (CVE-2026-17544)\n\nBug Fix(es) and Enhancement(s):\n\n* Rebase PHP to 8.4.24 for CVE-2026-17543 and CVE-2026-7260 and CVE-2026-17544 in 10.2.z (JIRA:Rocky Linux-223949)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-20T18:07:20.016374Z","modified":"2026-08-20T18:25:50.755793706Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-17544","description":"Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.","status":"published","published":"2026-07-30T12:17:00Z","modified":"2026-09-10T16:30:21.361432594Z","cvss":[{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"ALSA-2026:56969","title":"Important: php8.4 security, bug fix, and enhancement update","description":"PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.  \n\nSecurity Fix(es):  \n\n  * php: ext-pgsql: PHP: SQL injection via improper backslash escaping (CVE-2026-17543)\n  * php: PHP: Arbitrary code execution via out-of-bounds write in bccomp() (CVE-2026-17544)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Rebase PHP to 8.4.24 for CVE-2026-17543 and CVE-2026-7260 and CVE-2026-17544 in 10.2.z (JIRA:AlmaLinux-223949)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-19T00:00:00Z","modified":"2026-10-29T11:30:34.737531771Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"BIT-libphp-2026-17544","title":"Out-of-bounds write in bccomp() via crafted operand and scale","description":"Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.","status":"published","published":"2026-08-17T05:47:59.777Z","modified":"2026-09-10T16:01:41.689942529Z","updated_at":"2026-11-02T15:28:32.162822Z"},{"id":"BIT-php-2026-17544","title":"Out-of-bounds write in bccomp() via crafted operand and scale","description":"Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.","status":"published","published":"2026-08-17T05:53:36.291Z","modified":"2026-09-10T16:01:45.434794829Z","updated_at":"2026-11-02T15:28:34.343258Z"},{"id":"BIT-php-min-2026-17544","title":"Out-of-bounds write in bccomp() via crafted operand and scale","description":"Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.","status":"published","published":"2026-08-17T05:53:48.067Z","modified":"2026-09-10T16:01:45.299052211Z","updated_at":"2026-11-02T15:28:34.343258Z"},{"id":"MGASA-2026-0329","title":"Updated php8.4 packages fix security vulnerabilities","description":"The updated php 8.4 packages fix some security vulnerabilities. See the\nreferences for more information.\n","status":"published","published":"2026-08-10T19:29:27Z","modified":"2026-08-10T19:43:50.350629647Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"MGASA-2026-0330","title":"Updated php8.5 packages fix security vulnerabilities","description":"Updated php 8.5 packages fix some security vulnerabilities.\nFor details see the references.\n","status":"published","published":"2026-08-10T19:29:27Z","modified":"2026-08-10T19:43:49.873328834Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11418-1","title":"php8-8.5.9-1.1 on GA media","description":"These are all security issues fixed in the php8-8.5.9-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-01T00:00:00Z","modified":"2026-08-02T11:45:09.34169701Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21532-1","title":"Security update for php8","description":"This update for php8 fixes the following issues\n\n- Update to version 8.4.24\n- CVE-2026-7260: Stack overflow in phar with circular symlinks (bsc#1273077).\n- CVE-2026-9672: Upgrade libgd (bsc#1273078).\n- CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout (bsc#1273075).\n- CVE-2026-17544: Out-of-bounds write in bccomp() via crafted operand and scale (bsc#1273076).\n","status":"published","published":"2026-08-05T08:53:53Z","modified":"2026-08-06T18:23:57.731819614Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:23121-1","title":"Security update for php8","description":"This update for php8 fixes the following issues\n\n- Update to version 8.4.24\n- CVE-2026-7260: Stack overflow in phar with circular symlinks (bsc#1273077).\n- CVE-2026-9672: Upgrade libgd (bsc#1273078).\n- CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout (bsc#1273075).\n- CVE-2026-17544: Out-of-bounds write in bccomp() via crafted operand and scale (bsc#1273076).\n","status":"published","published":"2026-08-05T08:51:13Z","modified":"2026-08-14T18:23:39.869229807Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23144-1","title":"Security update for php8","description":"This update for php8 fixes the following issues\n\n- Update to version 8.4.24\n- CVE-2026-7260: Stack overflow in phar with circular symlinks (bsc#1273077).\n- CVE-2026-9672: Upgrade libgd (bsc#1273078).\n- CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout (bsc#1273075).\n- CVE-2026-17544: Out-of-bounds write in bccomp() via crafted operand and scale (bsc#1273076).\n","status":"published","published":"2026-08-05T08:51:13Z","modified":"2026-08-14T18:23:41.178689275Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3509-1","title":"Security update for php8","description":"This update for php8 fixes the following issues:\n  \nUpdate to version 8.3.33.\n\nSecurity issues fixed:\n\n- CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion\n  (bsc#1273077).\n- CVE-2026-9672: security issues in `libgd` (bsc#1273078).\n- CVE-2026-17543: improper escaping of backslashes in user-provided parameters allows for trivial SQL injection in\n  `ext-pgsql` (bsc#1273075).\n- CVE-2026-17544: php: Out-of-bounds write in bccomp() via crafted operand and scale (bsc#1273076)\n","status":"published","published":"2026-11-04T15:32:33Z","modified":"2026-11-04T23:13:33.142844629Z","updated_at":"2026-11-04T23:40:36.045471Z"},{"id":"USN-8743-1","title":"php8.1, php8.3, php8.5 vulnerabilities","description":"It was discovered that PHP incorrectly handled backslash escaping in the\nPostgreSQL extension. An attacker could use this issue to perform SQL\ninjection attacks. (CVE-2026-17543)\n\nIt was discovered that PHP incorrectly handled certain inputs to the\nbccomp() function. An attacker could use this issue to cause an out-of-\nbounds write, resulting in a denial of service or possibly execute\narbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-17544)\n\nIt was discovered that PHP incorrectly handled circular symbolic links in\nphar archives. An attacker could use this issue to cause unbounded\nrecursion, resulting in a denial of service. (CVE-2026-7260)","status":"published","published":"2026-09-10T11:48:08Z","modified":"2026-09-10T21:42:30.961321305Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}