In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.
CVSS Details
- CVSS 4.0 Base Score: 6.3 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libzip-develUpgrade php-dbgUpgrade php-pgsqlUpgrade php-commonUpgrade libzip-toolsUpgrade php-xmlUpgrade php-snmpUpgrade php-odbcUpgrade php-pecl-xdebugUpgrade php-xmlrpcUpgrade php-mbstringUpgrade php-pearUpgrade php-mysqlndUpgrade php-opcacheUpgrade php-intlUpgrade php-develUpgrade php-pecl-xdebug3Upgrade php-embeddedUpgrade php-gmpUpgrade php-fpmUpgrade php-pecl-apcu-develUpgrade libzipUpgrade php-cliUpgrade php-bcmathUpgrade php-enchantUpgrade php-dbaUpgrade php-jsonUpgrade php-processUpgrade php-gdUpgrade php-pdoUpgrade php-ldapUpgrade php-soapUpgrade php-pecl-rrdUpgrade php-pecl-zipUpgrade apcu-panelUpgrade phpUpgrade php-pecl-apcuUpgrade php-ffiUpgrade php-pecl-redis6 | Jun 1, 2026 | Jun 1, 2026 |
| Alpine Linux | — | Upgrade php85Upgrade php82Upgrade php84Upgrade php83Upgrade php81 | May 15, 2026 | May 10, 2026 |
| Amazon Linux Ami 2 | — | Upgrade phpUpgrade php-develUpgrade php-pgsqlUpgrade php-debuginfoUpgrade php-snmpUpgrade php-commonUpgrade php-odbcUpgrade php-fpmUpgrade php-xmlUpgrade php-ldapUpgrade php-dbgUpgrade php-sodiumUpgrade php-intlUpgrade php-bcmathUpgrade php-soapUpgrade php-mysqlndUpgrade php-opcacheUpgrade php-cliUpgrade php-dbaUpgrade php-mbstringUpgrade php-processUpgrade php-pdoUpgrade php-enchantUpgrade php-embeddedUpgrade php-gmpUpgrade php-gdUpgrade php-pspell | Jun 8, 2026 | Jun 8, 2026 |
| Amazon_linux_2023 | — | Upgrade php8.2-gmp-debuginfoUpgrade php8.5-pgsql-debuginfoUpgrade php8.5-mysqlndUpgrade php8.2-fpmUpgrade php8.4-dbg-debuginfoUpgrade php8.3-pdo-debuginfoUpgrade php8.3-intlUpgrade php8.2-mbstringUpgrade php8.3-common-debuginfoUpgrade php8.4-sodium-debuginfoUpgrade php8.4-develUpgrade php8.5-ldapUpgrade php8.3-commonUpgrade php8.3-ldapUpgrade php8.2-cli-debuginfoUpgrade php8.3-process-debuginfoUpgrade php8.4-common-debuginfoUpgrade php8.5-ffiUpgrade php8.5-snmp-debuginfoUpgrade php8.5-odbc-debuginfoUpgrade php8.5-gd-debuginfoUpgrade php8.5-bcmath-debuginfoUpgrade php8.4-tidy-debuginfoUpgrade php8.4-pgsqlUpgrade php8.4-pdoUpgrade php8.4-opcache-debuginfoUpgrade php8.4-opcacheUpgrade php8.4-ldap-debuginfoUpgrade php8.4-gmpUpgrade php8.4-embedded-debuginfoUpgrade php8.3-pgsql-debuginfoUpgrade php8.2-process-debuginfoUpgrade php8.5-dba-debuginfoUpgrade php8.4-dba-debuginfoUpgrade php8.3-zipUpgrade php8.3-gmp-debuginfoUpgrade php8.3-debugsourceUpgrade php8.2-pspellUpgrade php8.2-opcacheUpgrade php8.2-ldap-debuginfoUpgrade php8.5-cliUpgrade php8.4Upgrade php8.2-mbstring-debuginfoUpgrade php8.2-mysqlnd-debuginfoUpgrade php8.2-gmpUpgrade php8.5-mysqlnd-debuginfoUpgrade php8.5-embedded-debuginfoUpgrade php8.5-dbgUpgrade php8.4-zipUpgrade php8.4-xml-debuginfoUpgrade php8.2-snmpUpgrade php8.2-pdoUpgrade php8.4-enchant-debuginfoUpgrade php8.3-pdoUpgrade php8.3-dba-debuginfoUpgrade php8.2-tidy-debuginfoUpgrade php8.2-soap-debuginfoUpgrade php8.2-enchantUpgrade php8.2Upgrade php8.5-zipUpgrade php8.5-soap-debuginfoUpgrade php8.5-odbcUpgrade php8.5-enchant-debuginfoUpgrade php8.4-soap-debuginfoUpgrade php8.3-opcache-debuginfoUpgrade php8.3-mysqlnd-debuginfoUpgrade php8.3-mysqlndUpgrade php8.3-debuginfoUpgrade php8.2-pgsqlUpgrade php8.3-snmpUpgrade php8.2-pspell-debuginfoUpgrade php8.2-tidyUpgrade php8.2-intlUpgrade php8.2-embeddedUpgrade php8.2-commonUpgrade php8.5-gdUpgrade php8.4-enchantUpgrade php8.2-soapUpgrade php8.2-opcache-debuginfoUpgrade php8.2-common-debuginfoUpgrade php8.2-dba-debuginfoUpgrade php8.5-gmp-debuginfoUpgrade php8.4-mysqlndUpgrade php8.5-fpmUpgrade php8.4-zip-debuginfoUpgrade php8.4-process-debuginfoUpgrade php8.4-mbstringUpgrade php8.3-zip-debuginfoUpgrade php8.3-xml-debuginfoUpgrade php8.3-modphp-debuginfoUpgrade php8.2-sodium-debuginfoUpgrade php8.2-dbg-debuginfoUpgrade php8.2-xmlUpgrade php8.5-bcmathUpgrade php8.4-modphpUpgrade php8.3-sodiumUpgrade php8.3-processUpgrade php8.3-fpmUpgrade php8.2-develUpgrade php8.2-debugsourceUpgrade php8.5-zip-debuginfoUpgrade php8.5-tidyUpgrade php8.5-sodiumUpgrade php8.5-soapUpgrade php8.5-pgsqlUpgrade php8.2-embedded-debuginfoUpgrade php8.2-dbgUpgrade php8.5-commonUpgrade php8.5-develUpgrade php8.5-debugsourceUpgrade php8.4-tidyUpgrade php8.4-gmp-debuginfoUpgrade php8.4-sodiumUpgrade php8.3-enchant-debuginfoUpgrade php8.3-dbaUpgrade php8.3-intl-debuginfoUpgrade php8.3-ffiUpgrade php8.4-odbcUpgrade php8.5-dbaUpgrade php8.3-ldap-debuginfoUpgrade php8.5-intlUpgrade php8.2-cliUpgrade php8.4-fpmUpgrade php8.3-gdUpgrade php8.3-tidyUpgrade php8.5-pdo-debuginfoUpgrade php8.2-pgsql-debuginfoUpgrade php8.2-ffiUpgrade php8.4-fpm-debuginfoUpgrade php8.5-intl-debuginfoUpgrade php8.4-cli-debuginfoUpgrade php8.3-gmpUpgrade php8.4-gdUpgrade php8.4-ffi-debuginfoUpgrade php8.5-sodium-debuginfoUpgrade php8.5Upgrade php8.4-snmpUpgrade php8.4-modphp-debuginfoUpgrade php8.4-intlUpgrade php8.4-embeddedUpgrade php8.4-dbaUpgrade php8.4-commonUpgrade php8.4-intl-debuginfoUpgrade php8.2-odbc-debuginfoUpgrade php8.5-ldap-debuginfoUpgrade php8.4-cliUpgrade php8.3-pgsqlUpgrade php8.3-modphpUpgrade php8.3-gd-debuginfoUpgrade php8.2-ldapUpgrade php8.5-xmlUpgrade php8.3-dbg-debuginfoUpgrade php8.3-fpm-debuginfoUpgrade php8.2-bcmathUpgrade php8.2-zipUpgrade php8.2-gdUpgrade php8.4-debuginfoUpgrade php8.3-snmp-debuginfoUpgrade php8.3-odbcUpgrade php8.3-bcmath-debuginfoUpgrade php8.2-zip-debuginfoUpgrade php8.2-sodiumUpgrade php8.5-modphpUpgrade php8.4-odbc-debuginfoUpgrade php8.5-processUpgrade php8.5-modphp-debuginfoUpgrade php8.4-processUpgrade php8.4-ffiUpgrade php8.2-intl-debuginfoUpgrade php8.5-enchantUpgrade php8.5-common-debuginfoUpgrade php8.3-mbstring-debuginfoUpgrade php8.2-enchant-debuginfoUpgrade php8.2-odbcUpgrade php8.3-embedded-debuginfoUpgrade php8.3-pspell-debuginfoUpgrade php8.5-pdoUpgrade php8.5-tidy-debuginfoUpgrade php8.5-process-debuginfoUpgrade php8.5-fpm-debuginfoUpgrade php8.4-pgsql-debuginfoUpgrade php8.4-pdo-debuginfoUpgrade php8.4-bcmathUpgrade php8.3-sodium-debuginfoUpgrade php8.2-processUpgrade php8.3-enchantUpgrade php8.3-develUpgrade php8.2-pdo-debuginfoUpgrade php8.4-mysqlnd-debuginfoUpgrade php8.2-gd-debuginfoUpgrade php8.2-bcmath-debuginfoUpgrade php8.2-debuginfoUpgrade php8.3-xmlUpgrade php8.5-xml-debuginfoUpgrade php8.5-snmpUpgrade php8.4-xmlUpgrade php8.3-pspellUpgrade php8.3-ffi-debuginfoUpgrade php8.4-soapUpgrade php8.3-bcmathUpgrade php8.5-debuginfoUpgrade php8.4-ldapUpgrade php8.4-gd-debuginfoUpgrade php8.3-opcacheUpgrade php8.3-tidy-debuginfoUpgrade php8.4-debugsourceUpgrade php8.3-dbgUpgrade php8.2-mysqlndUpgrade php8.2-fpm-debuginfoUpgrade php8.4-dbgUpgrade php8.5-gmpUpgrade php8.4-snmp-debuginfoUpgrade php8.3-soapUpgrade php8.2-snmp-debuginfoUpgrade php8.3-soap-debuginfoUpgrade php8.3-cliUpgrade php8.3-odbc-debuginfoUpgrade php8.2-ffi-debuginfoUpgrade php8.5-ffi-debuginfoUpgrade php8.3Upgrade php8.5-mbstringUpgrade php8.5-cli-debuginfoUpgrade php8.4-mbstring-debuginfoUpgrade php8.4-bcmath-debuginfoUpgrade php8.3-mbstringUpgrade php8.2-xml-debuginfoUpgrade php8.2-dbaUpgrade php8.5-mbstring-debuginfoUpgrade php8.5-embeddedUpgrade php8.3-embeddedUpgrade php8.3-cli-debuginfoUpgrade php8.5-dbg-debuginfo | May 28, 2026 | May 10, 2026 |
| Debian | — | Upgrade php8.4Upgrade php7.4Upgrade php8.2 | May 10, 2026 | May 10, 2026 |
| Oracle_linux | — | Upgrade php-dbgUpgrade php-mbstringUpgrade php-pdoUpgrade php-soapUpgrade php-odbcUpgrade php-pgsqlUpgrade php-bcmathUpgrade php-develUpgrade php-pecl-zipUpgrade php-pecl-apcu-develUpgrade php-gmpUpgrade php-fpmUpgrade php-dbaUpgrade php-commonUpgrade php-ffiUpgrade php-pearUpgrade php-pecl-xdebug3Upgrade php-ldapUpgrade php-pecl-rrdUpgrade php-opcacheUpgrade php-cliUpgrade php-gdUpgrade phpUpgrade php-xmlUpgrade apcu-panelUpgrade libzip-develUpgrade libzipUpgrade php-intlUpgrade php-snmpUpgrade php-processUpgrade php-pecl-apcuUpgrade php-enchantUpgrade php-embeddedUpgrade php-mysqlndUpgrade libzip-tools | Jun 4, 2026 | May 10, 2026 |
| Redhat_linux | — | Upgrade php-pecl-rrdUpgrade php8.4-dbgUpgrade php8.4-pgsql-debuginfoUpgrade php8.4-debugsourceUpgrade php8.4-fpm-debuginfoUpgrade php8.4-gmp-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-develUpgrade php-processUpgrade php-snmp-debuginfoUpgrade php-pecl-apcu-develUpgrade php8.4-dbaUpgrade php8.4-pdo-debuginfoUpgrade php-pecl-xdebug3Upgrade php-pecl-xdebug3-debugsourceUpgrade php8.4-opcacheUpgrade php8.4-enchant-debuginfoUpgrade php-soapUpgrade php8.4-opcache-debuginfoUpgrade php-dba-debuginfoUpgrade php-pearUpgrade php8.4-snmpUpgrade php-fpmUpgrade php8.4-develUpgrade php8.4-ffi-debuginfoUpgrade php8.4-pgsqlUpgrade php-pecl-xdebug-debuginfoUpgrade php-dbg-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php8.4-commonUpgrade php-pgsqlUpgrade php-xmlrpc-debuginfoUpgrade php8.4-bcmathUpgrade php8.4-mbstring-debuginfoUpgrade php-commonUpgrade php8.4-process-debuginfoUpgrade php-odbc-debuginfoUpgrade php8.4-odbc-debuginfoUpgrade php8.4-xml-debuginfoUpgrade php-pdoUpgrade php8.4-gmpUpgrade php8.4-processUpgrade php-intl-debuginfoUpgrade php-mbstringUpgrade php-xmlUpgrade php8.4-odbcUpgrade php-debuginfoUpgrade php8.4-bcmath-debuginfoUpgrade php-gmpUpgrade php-ldap-debuginfoUpgrade php-pdo-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-xdebugUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcu-debuginfoUpgrade php-xmlrpcUpgrade php-jsonUpgrade php-common-debuginfoUpgrade php-opcache-debuginfoUpgrade php8.4-gdUpgrade php-pecl-redis6-debugsourceUpgrade php-xml-debuginfoUpgrade php8.4-snmp-debuginfoUpgrade php-bcmathUpgrade php-mbstring-debuginfoUpgrade libzip-develUpgrade php8.4-gd-debuginfoUpgrade apcu-panelUpgrade php8.4-embeddedUpgrade php-dbaUpgrade php8.4-fpmUpgrade php8.4-ffiUpgrade php-dbgUpgrade php8.4-dba-debuginfoUpgrade libzip-debuginfoUpgrade php-debugsourceUpgrade php-embeddedUpgrade php-json-debuginfoUpgrade php8.4-dbg-debuginfoUpgrade php8.4-cli-debuginfoUpgrade phpUpgrade php8.4-cliUpgrade php-process-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-odbcUpgrade php-fpm-debuginfoUpgrade php-cliUpgrade php-pecl-apcuUpgrade php-pecl-apcu-debugsourceUpgrade php-embedded-debuginfoUpgrade php-gdUpgrade libzipUpgrade php8.4-intlUpgrade php-pecl-redis6-debuginfoUpgrade php-enchant-debuginfoUpgrade php-cli-debuginfoUpgrade libzip-toolsUpgrade libzip-debugsourceUpgrade php8.4-xmlUpgrade php-ffi-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php8.4-common-debuginfoUpgrade php8.4-soapUpgrade php-bcmath-debuginfoUpgrade php8.4-enchantUpgrade php8.4-ldap-debuginfoUpgrade php-pecl-zipUpgrade php-snmpUpgrade php-ldapUpgrade php-pgsql-debuginfoUpgrade php8.4-pdoUpgrade php-pecl-redis6Upgrade php-mysqlndUpgrade php-gd-debuginfoUpgrade php8.4-mysqlnd-debuginfoUpgrade php8.4Upgrade php-pecl-xdebug3-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-gmp-debuginfoNo solution existsUpgrade php8.4-soap-debuginfoUpgrade php8.4-intl-debuginfoUpgrade php8.4-mbstringUpgrade php8.4-ldapUpgrade php-intlUpgrade php-ffiUpgrade php-enchantUpgrade php8.4-mysqlndUpgrade php8.4-embedded-debuginfoUpgrade php-soap-debuginfoUpgrade php-opcacheUpgrade php8.4-debuginfo | Jun 3, 2026 | May 10, 2026 |
| Rocky_linux | — | Upgrade php-odbcUpgrade php-pgsql-debuginfoUpgrade php8.4-soap-debuginfoUpgrade php8.4-snmp-debuginfoUpgrade php8.4-mbstringUpgrade php8.4-mysqlnd-debuginfoUpgrade php8.4-embedded-debuginfoUpgrade php-mbstring-debuginfoUpgrade php8.4-fpm-debuginfoUpgrade php8.4-embeddedUpgrade php-pecl-xdebug3-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-dba-debuginfoUpgrade php-soap-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php8.4-enchantUpgrade php-xml-debuginfoUpgrade php-pgsqlUpgrade php-pecl-redis6-debuginfoUpgrade php-commonUpgrade php8.4-xmlUpgrade php8.4-odbc-debuginfoUpgrade php8.4-ffiUpgrade php-pecl-xdebug-debugsourceUpgrade php8.4-gmpUpgrade php8.4-bcmath-debuginfoUpgrade php-xmlUpgrade php-snmpUpgrade php-pecl-xdebugUpgrade php-opcache-debuginfoUpgrade php-ffi-debuginfoUpgrade php-enchant-debuginfoUpgrade php-debuginfoUpgrade php-cliUpgrade php8.4-mysqlndUpgrade php8.4-enchant-debuginfoUpgrade php-pecl-xdebug3Upgrade php-pecl-apcu-debugsourceUpgrade php-pecl-apcuUpgrade php-ldapUpgrade php-ffiUpgrade libzip-develUpgrade php8.4-pgsql-debuginfoUpgrade php8.4-cli-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-develUpgrade php8.4-pgsqlUpgrade php8.4-gmp-debuginfoUpgrade php-dbgUpgrade php-fpm-debuginfoUpgrade php8.4-common-debuginfoUpgrade php8.4-gdUpgrade libzip-toolsUpgrade libzip-debuginfoUpgrade php-json-debuginfoUpgrade php-fpmUpgrade php-pecl-zip-debuginfoUpgrade php8.4-ldapUpgrade php8.4-intl-debuginfoUpgrade php8.4-ffi-debuginfoUpgrade php8.4-debuginfoUpgrade php-intlUpgrade php8.4-snmpUpgrade php8.4-ldap-debuginfoUpgrade php-common-debuginfoUpgrade php-pecl-xdebug3-debugsourceUpgrade phpUpgrade php8.4-process-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-pecl-zipUpgrade php8.4-opcache-debuginfoUpgrade php-dbaUpgrade libzip-debugsourceUpgrade php8.4-soapUpgrade php-enchantUpgrade php-jsonUpgrade php-gmp-debuginfoUpgrade php8.4-pdo-debuginfoUpgrade php-dbg-debuginfoUpgrade php-gd-debuginfoUpgrade php-embedded-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-mysqlndUpgrade php-gmpUpgrade php-gdUpgrade php-embeddedUpgrade php-bcmathUpgrade php8.4-pdoUpgrade php8.4-opcacheUpgrade php8.4-odbcUpgrade php-pdo-debuginfoUpgrade php8.4-fpmUpgrade php8.4-debugsourceUpgrade php8.4-dbgUpgrade php8.4-dbaUpgrade php8.4Upgrade php-xmlrpc-debuginfoUpgrade php-odbc-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade libzipUpgrade php8.4-intlUpgrade php8.4-dbg-debuginfoUpgrade php8.4-commonUpgrade php-pecl-zip-debugsourceUpgrade php-intl-debuginfoUpgrade libzip-tools-debuginfoUpgrade php8.4-processUpgrade php8.4-mbstring-debuginfoUpgrade php-pdoUpgrade php-opcacheUpgrade php8.4-bcmathUpgrade php-pecl-redis6-debugsourceUpgrade php-cli-debuginfoUpgrade php-ldap-debuginfoUpgrade php8.4-develUpgrade php8.4-dba-debuginfoUpgrade php-xmlrpcUpgrade php-soapUpgrade php-snmp-debuginfoUpgrade php8.4-gd-debuginfoUpgrade php-process-debuginfoUpgrade php-processUpgrade php-pecl-rrdUpgrade php8.4-cliUpgrade php-pecl-apcu-develUpgrade php-mbstringUpgrade php8.4-xml-debuginfoUpgrade php-debugsource | Jun 2, 2026 | Jun 1, 2026 |
| Ubuntu | — | Upgrade php8.4Upgrade php8.5Upgrade php8.3 | May 28, 2026 | May 10, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub