{"id":"CVE-2026-6104","aliases":["ALPINE-CVE-2026-6104","ALSA-2026:22649","BELL-CVE-2026-6104","BIT-libphp-2026-6104","BIT-php-2026-6104","BIT-php-min-2026-6104","DEBIAN-CVE-2026-6104","EUVD-2026-28979","GHSA-74r9-qxhc-fx53","RHSA-2026:22649","RLSA-2026:22649","SUSE-SU-2026:21612-1","UBUNTU-CVE-2026-6104","openSUSE-SU-2026:10747-1","openSUSE-SU-2026:20745-1"],"status":"published","title":"Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding","description":"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L/RE:M/U:Amber","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00469,"percentile":0.41008,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-05-10T04:35:17Z","modified":"2026-11-11T02:55:53Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"php84","fixed_in":["8.4.27-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"php84","fixed_in":["8.4.21-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"php85","fixed_in":["8.5.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"php85","fixed_in":["8.5.6-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"libphp","fixed_in":["8.4.21","8.5.6"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"php","fixed_in":["8.4.21","8.5.6"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"php-min","fixed_in":["8.4.21","8.5.6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"php8.4","fixed_in":["8.4.21-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"php8.4","fixed_in":["8.4.21-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"php8.4","fixed_in":["8.4.11-1ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"php8.5","fixed_in":["8.5.4-0ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"php84","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.27-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"php84","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"php85","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"php85","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-ffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"php8.4-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Bitnami","package":"libphp","ranges":[{"type":"SEMVER","events":[{"introduced":"8.4.0"},{"fixed":"8.4.21"},{"introduced":"8.5.0"},{"fixed":"8.5.6"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"php","ranges":[{"type":"SEMVER","events":[{"introduced":"8.4.0"},{"fixed":"8.4.21"},{"introduced":"8.5.0"},{"fixed":"8.5.6"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"php-min","ranges":[{"type":"SEMVER","events":[{"introduced":"8.4.0"},{"fixed":"8.4.21"},{"introduced":"8.5.0"},{"fixed":"8.5.6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"php8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1~deb13u1"}]}],"versions":["8.4.11-1","8.4.16-1","8.4.16-1~deb13u1","8.4.20-1"]},{"source":"osv","ecosystem":"Debian:14","package":"php8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.21-1"}]}],"versions":["8.4.11-1","8.4.16-1","8.4.16-1~deb13u1","8.4.20-1","8.4.21-1~deb13u1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-bcmath-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-cli-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-dba-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-dbg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-embedded-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-enchant-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-ffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-ffi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-fpm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-gd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-gmp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-intl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-mbstring-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-mysqlnd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-odbc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-opcache-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-pdo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-process-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-snmp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-soap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"php8.4-xml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:10","package":"php8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.21-1.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"php8.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.11-1ubuntu1.2"}]}],"versions":["8.4.5-1ubuntu1","8.4.8-1ubuntu1","8.4.11-1ubuntu1","8.4.11-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"php8.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.4-0ubuntu1.1"}]}],"versions":["8.5.2-0ubuntu1","8.5.4-0ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-1.1"}]}],"bundled":11}],"products":[{"vendor":"php","product":"php"},{"vendor":"php group","product":"php"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"}],"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53","tags":["vendor-advisory","Vendor Advisory","advisory","article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6104","tags":["vdb-entry","x_refsource_REDHAT","report","web","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468573","tags":["issue-tracking","x_refsource_REDHAT","web","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6104.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22649","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-6104","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6735","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-7258","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-7262","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-7263","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-7568","tags":["report"]},{"url":"https://bugzilla.redhat.com/2468561","tags":["report"]},{"url":"https://bugzilla.redhat.com/2468562","tags":["report"]},{"url":"https://bugzilla.redhat.com/2468565","tags":["report"]},{"url":"https://bugzilla.redhat.com/2468566","tags":["report"]},{"url":"https://bugzilla.redhat.com/2468572","tags":["report"]},{"url":"https://bugzilla.redhat.com/2468573","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-22649.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-6722.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-7261.html","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-6104","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6104","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6104.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-6104","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468561","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468562","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468565","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468566","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468572","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22649.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6104","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468560","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6722","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6722","tags":["advisory"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6735","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6735","tags":["advisory"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7258","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7258","tags":["advisory"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-7261","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468563","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7261","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7261","tags":["advisory"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7262","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7262","tags":["advisory"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7263","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7263","tags":["advisory"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7568","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7568","tags":["advisory"]},{"url":"https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:22649","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621612-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264769","tags":["report"]},{"url":"https://bugzilla.suse.com/1264770","tags":["report"]},{"url":"https://bugzilla.suse.com/1264771","tags":["report"]},{"url":"https://bugzilla.suse.com/1264772","tags":["report"]},{"url":"https://bugzilla.suse.com/1264773","tags":["report"]},{"url":"https://bugzilla.suse.com/1264774","tags":["report"]},{"url":"https://bugzilla.suse.com/1264775","tags":["report"]},{"url":"https://bugzilla.suse.com/1264776","tags":["report"]},{"url":"https://bugzilla.suse.com/1264777","tags":["report"]},{"url":"https://bugzilla.suse.com/1264778","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7568","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-6104","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8336-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42371","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-6104","title":"Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding","description":"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.","status":"published","published":"2026-05-10T04:35:17.328Z","modified":"2026-07-15T00:41:42.455Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L/RE:M/U:Amber","level":"medium","assessor":"cna"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-125","CWE-125"],"updated_at":"2026-11-02T13:49:53.818886Z"}],"euvd":[{"id":"EUVD-2026-28979","description":"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.","status":"published","published":"2026-05-10T04:35:17Z","modified":"2026-07-15T00:41:42Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L/RE:M/U:Amber","level":"medium"}],"updated_at":"2026-11-02T18:19:56.918546Z"}],"nvd":[{"id":"CVE-2026-6104","description":"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.","status":"published","published":"2026-05-10T06:16:07.397Z","modified":"2026-07-24T08:10:00.15Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Amber","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:12:18.239974Z"}],"osv":[{"id":"ALPINE-CVE-2026-6104","description":"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.","status":"published","published":"2026-05-10T06:16:07.397Z","modified":"2026-11-03T06:32:57.13732293Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"BELL-CVE-2026-6104","title":"CVE-2026-6104 does not affect BellSoft software","status":"withdrawn","published":"2026-05-21T06:10:54.985133Z","modified":"2026-05-26T07:15:15.119177227Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:24.959902Z"},{"id":"CVE-2026-6104","title":"Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding","description":"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.","status":"published","published":"2026-05-10T04:35:17.328Z","modified":"2026-11-11T02:55:53.626589335Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L/RE:M/U:Amber","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-11T03:21:13.402158Z"},{"id":"DEBIAN-CVE-2026-6104","description":"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.","status":"published","published":"2026-05-10T06:16:07.397Z","modified":"2026-10-01T03:03:28.752915915Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"RHSA-2026:22649","title":"Red Hat Security Advisory: php8.4 security update","status":"published","published":"2026-06-03T10:20:16Z","modified":"2026-09-22T10:09:40Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RLSA-2026:22649","title":"Important: php8.4 security update","description":"PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.\n\nSecurity Fix(es):\n\n* PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258)\n\n* PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735)\n\n* php: NULL pointer dereference in SOAP apache:Map decoder with missing \u003cvalue\u003e (CVE-2026-7262)\n\n* php: signed integer overflow in metaphone() (CVE-2026-7568)\n\n* php: denial of service via DOMNode::C14N() (CVE-2026-7263)\n\n* php: global buffer over-read in mb_convert_encoding() with attacker-supplied encoding (CVE-2026-6104)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-05T12:04:50.053452Z","modified":"2026-06-05T12:30:05.848902694Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"UBUNTU-CVE-2026-6104","description":"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.","status":"published","published":"2026-05-10T06:16:00Z","modified":"2026-06-30T18:18:08.268987107Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L/RE:M/U:Amber","level":"medium"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"ALSA-2026:22649","title":"Important: php8.4 security update","description":"PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.  \n\nSecurity Fix(es):  \n\n  * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258)\n  * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735)\n  * php: NULL pointer dereference in SOAP apache:Map decoder with missing \u003cvalue\u003e (CVE-2026-7262)\n  * php: signed integer overflow in metaphone() (CVE-2026-7568)\n  * php: denial of service via DOMNode::C14N() (CVE-2026-7263)\n  * php: global buffer over-read in mb_convert_encoding() with attacker-supplied encoding (CVE-2026-6104)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-02T00:00:00Z","modified":"2026-11-06T12:00:03.723699294Z","updated_at":"2026-11-06T12:12:56.168821Z"},{"id":"BIT-libphp-2026-6104","title":"Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding","description":"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.","status":"published","published":"2026-05-12T08:50:20.245Z","modified":"2026-11-11T02:55:53.626589335Z","updated_at":"2026-11-11T03:21:13.402158Z"},{"id":"BIT-php-2026-6104","title":"Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding","description":"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.","status":"published","published":"2026-05-12T08:55:59.545Z","modified":"2026-11-11T02:55:53.626589335Z","updated_at":"2026-11-11T03:21:13.402158Z"},{"id":"BIT-php-min-2026-6104","title":"Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding","description":"In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.","status":"published","published":"2026-05-12T08:56:09.226Z","modified":"2026-11-11T02:55:53.626589335Z","updated_at":"2026-11-11T03:21:13.402158Z"},{"id":"openSUSE-SU-2026:10747-1","title":"php8-8.5.6-1.1 on GA media","description":"These are all security issues fixed in the php8-8.5.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-11T00:00:00Z","modified":"2026-05-12T08:45:39.938086Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20745-1","title":"Security update for php8","description":"This update for php8 fixes the following issues\n\n- CVE-2025-14179: improper handling of NULL bytes by the PDO Firebird driver when preparing SQL queries can lead to SQL\n  injection (bsc#1264778).\n- CVE-2026-6104: out-of-bounds read when processing an encoding name containing an embedded NULL byte in\n  `mb_convert_encoding()` can lead to information disclosure and denial of service (bsc#1264777).\n- CVE-2026-6722: use-after-free in SOAP using Apache map can lead to remote code execution (bsc#1264776).\n- CVE-2026-6735: improper validation of the request URI within the PHP-FPM status page can lead to XSS (bsc#1264775).\n- CVE-2026-7258: signed `char` values passed to `ctype` functions like `isxdigit` can lead to OOB access and denial of\n  service (bsc#1264774).\n- CVE-2026-7259: NULL pointer dereference in `php_mb_check_encoding()` via `mb_ereg_search_init()` can lead to a denial\n  of service (bsc#1264773).\n- CVE-2026-7261: use-after-free due to incorrectly handled persistence of handler objects when SOAP_PERSISTENCE_SESSION\n  is configured can lead to memory corruption, information disclosure and process crashes (bsc#1264772).\n- CVE-2026-7262: NULL pointer dereference caused by mistake in the SOAP decoding process when a typemap is configured\n  can lead to a denial of service (bsc#1264771).\n- CVE-2026-7263: incorrect processing of XML data in the `DOMNode: C14N()` method can lead to an infinite loop and a\n  denial of service (bsc#1264770).\n- CVE-2026-7568: integer overflow in the `metaphone` function can lead to undefined behavior and affect the availability\n  of the PHPprocess (bsc#1264769).\n\nOther updates:\n\n- Updated to 8.4.21.\n","status":"published","published":"2026-05-13T08:01:02Z","modified":"2026-05-19T18:23:48.116157491Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:21612-1","title":"Security update for php8","description":"This update for php8 fixes the following issues\n\n- CVE-2025-14179: improper handling of NULL bytes by the PDO Firebird driver when preparing SQL queries can lead to SQL\n  injection (bsc#1264778).\n- CVE-2026-6104: out-of-bounds read when processing an encoding name containing an embedded NULL byte in\n  `mb_convert_encoding()` can lead to information disclosure and denial of service (bsc#1264777).\n- CVE-2026-6722: use-after-free in SOAP using Apache map can lead to remote code execution (bsc#1264776).\n- CVE-2026-6735: improper validation of the request URI within the PHP-FPM status page can lead to XSS (bsc#1264775).\n- CVE-2026-7258: signed `char` values passed to `ctype` functions like `isxdigit` can lead to OOB access and denial of\n  service (bsc#1264774).\n- CVE-2026-7259: NULL pointer dereference in `php_mb_check_encoding()` via `mb_ereg_search_init()` can lead to a denial\n  of service (bsc#1264773).\n- CVE-2026-7261: use-after-free due to incorrectly handled persistence of handler objects when SOAP_PERSISTENCE_SESSION\n  is configured can lead to memory corruption, information disclosure and process crashes (bsc#1264772).\n- CVE-2026-7262: NULL pointer dereference caused by mistake in the SOAP decoding process when a typemap is configured\n  can lead to a denial of service (bsc#1264771).\n- CVE-2026-7263: incorrect processing of XML data in the `DOMNode: C14N()` method can lead to an infinite loop and a\n  denial of service (bsc#1264770).\n- CVE-2026-7568: integer overflow in the `metaphone` function can lead to undefined behavior and affect the availability\n  of the PHPprocess (bsc#1264769).\n\nOther updates:\n\n- Updated to 8.4.21.\n","status":"published","published":"2026-05-13T07:57:49Z","modified":"2026-05-16T18:23:54.211927Z","updated_at":"2026-11-02T15:54:02.312556Z"}]}}