In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade php84Upgrade php82Upgrade php83Upgrade php85 | Jul 31, 2026 | Jul 3, 2026 |
| Amazon Linux Ami 2 | — | Upgrade php-odbcUpgrade php-mysqlndUpgrade php-opcacheUpgrade php-cliUpgrade php-soapUpgrade php-embeddedUpgrade phpUpgrade php-ldapUpgrade php-processUpgrade php-pgsqlUpgrade php-commonUpgrade php-gdUpgrade php-dbaUpgrade php-sodiumUpgrade php-dbgUpgrade php-pspellUpgrade php-intlUpgrade php-snmpUpgrade php-debuginfoUpgrade php-xmlUpgrade php-pdoUpgrade php-gmpUpgrade php-develUpgrade php-fpmUpgrade php-mbstringUpgrade php-bcmathUpgrade php-enchant | Jul 21, 2026 | Jul 21, 2026 |
| Amazon_linux_2023 | — | Upgrade php8.4-sodiumUpgrade php8.4-tidyUpgrade php8.5-dbg-debuginfoUpgrade php8.5-gd-debuginfoUpgrade php8.2-pdo-debuginfoUpgrade php8.2-processUpgrade php8.2-mbstring-debuginfoUpgrade php8.2-snmp-debuginfoUpgrade php8.5-enchant-debuginfoUpgrade php8.2-common-debuginfoUpgrade php8.2-gdUpgrade php8.2-xml-debuginfoUpgrade php8.4-ffiUpgrade php8.4-intl-debuginfoUpgrade php8.3-processUpgrade php8.4-mysqlnd-debuginfoUpgrade php8.3-gdUpgrade php8.3-opcache-debuginfoUpgrade php8.4-pgsql-debuginfoUpgrade php8.4-common-debuginfoUpgrade php8.3-develUpgrade php8.2-bcmathUpgrade php8.2-dba-debuginfoUpgrade php8.4-embeddedUpgrade php8.5-dbaUpgrade php8.4-odbc-debuginfoUpgrade php8.2-dbgUpgrade php8.4-cliUpgrade php8.5-sodium-debuginfoUpgrade php8.3-fpm-debuginfoUpgrade php8.2-mysqlndUpgrade php8.2-enchantUpgrade php8.3-dbaUpgrade php8.3-debuginfoUpgrade php8.3-embeddedUpgrade php8.4-ffi-debuginfoUpgrade php8.3-xmlUpgrade php8.4-soapUpgrade php8.5-ldap-debuginfoUpgrade php8.3-snmpUpgrade php8.5-pgsql-debuginfoUpgrade php8.3-cliUpgrade php8.5-debuginfoUpgrade php8.4-fpmUpgrade php8.3-mbstring-debuginfoUpgrade php8.3-pgsql-debuginfoUpgrade php8.2-intlUpgrade php8.3-tidyUpgrade php8.5-dba-debuginfoUpgrade php8.4-gmpUpgrade php8.2-develUpgrade php8.4Upgrade php8.4-ldapUpgrade php8.5-common-debuginfoUpgrade php8.5-tidy-debuginfoUpgrade php8.3-gmpUpgrade php8.5-bcmathUpgrade php8.5-develUpgrade php8.5-soap-debuginfoUpgrade php8.2-opcacheUpgrade php8.2-pdoUpgrade php8.2-fpmUpgrade php8.3Upgrade php8.3-dbg-debuginfoUpgrade php8.4-sodium-debuginfoUpgrade php8.2-debuginfoUpgrade php8.3-dbgUpgrade php8.4-fpm-debuginfoUpgrade php8.4-opcache-debuginfoUpgrade php8.3-mbstringUpgrade php8.5-debugsourceUpgrade php8.5-mysqlnd-debuginfoUpgrade php8.2-embedded-debuginfoUpgrade php8.5-modphpUpgrade php8.3-ffi-debuginfoUpgrade php8.4-cli-debuginfoUpgrade php8.2-odbcUpgrade php8.4-pdoUpgrade php8.2-pgsql-debuginfoUpgrade php8.5-snmpUpgrade php8.5-zipUpgrade php8.5-gmpUpgrade php8.5-modphp-debuginfoUpgrade php8.5-mysqlndUpgrade php8.4-xmlUpgrade php8.3-pspellUpgrade php8.2-embeddedUpgrade php8.4-mysqlndUpgrade php8.5-cliUpgrade php8.5-cli-debuginfoUpgrade php8.5-embedded-debuginfoUpgrade php8.4-debugsourceUpgrade php8.2-pgsqlUpgrade php8.3-enchant-debuginfoUpgrade php8.2-process-debuginfoUpgrade php8.4-embedded-debuginfoUpgrade php8.4-ldap-debuginfoUpgrade php8.4-mbstringUpgrade php8.3-xml-debuginfoUpgrade php8.5-ffi-debuginfoUpgrade php8.2-debugsourceUpgrade php8.5-enchantUpgrade php8.5-gdUpgrade php8.2-tidyUpgrade php8.3-mysqlndUpgrade php8.3-ldap-debuginfoUpgrade php8.4-modphpUpgrade php8.4-debuginfoUpgrade php8.4-commonUpgrade php8.5Upgrade php8.4-dba-debuginfoUpgrade php8.4-opcacheUpgrade php8.3-pdo-debuginfoUpgrade php8.3-modphpUpgrade php8.3-ldapUpgrade php8.3-intl-debuginfoUpgrade php8.2-zipUpgrade php8.2-mbstringUpgrade php8.5-sodiumUpgrade php8.3-opcacheUpgrade php8.2-cli-debuginfoUpgrade php8.5-process-debuginfoUpgrade php8.5-gmp-debuginfoUpgrade php8.5-bcmath-debuginfoUpgrade php8.3-sodium-debuginfoUpgrade php8.3-pgsqlUpgrade php8.3-gd-debuginfoUpgrade php8.3-embedded-debuginfoUpgrade php8.5-ldapUpgrade php8.2-soap-debuginfoUpgrade php8.2-gmp-debuginfoUpgrade php8.3-intlUpgrade php8.5-snmp-debuginfoUpgrade php8.5-pdo-debuginfoUpgrade php8.5-odbc-debuginfoUpgrade php8.5-ffiUpgrade php8.4-gdUpgrade php8.3-dba-debuginfoUpgrade php8.5-dbgUpgrade php8.4-dbg-debuginfoUpgrade php8.4-dbaUpgrade php8.3-gmp-debuginfoUpgrade php8.3-commonUpgrade php8.2-zip-debuginfoUpgrade php8.2-pspellUpgrade php8.5-tidyUpgrade php8.2-opcache-debuginfoUpgrade php8.2-gmpUpgrade php8.5-zip-debuginfoUpgrade php8.5-embeddedUpgrade php8.2-dbg-debuginfoUpgrade php8.4-modphp-debuginfoUpgrade php8.4-intlUpgrade php8.4-develUpgrade php8.3-zip-debuginfoUpgrade php8.3-soap-debuginfoUpgrade php8.3-bcmathUpgrade php8.2-sodiumUpgrade php8.2-snmpUpgrade php8.2-intl-debuginfoUpgrade php8.2-fpm-debuginfoUpgrade php8.4-zipUpgrade php8.4-enchantUpgrade php8.3-ffiUpgrade php8.5-fpmUpgrade php8.2-ldapUpgrade php8.5-soapUpgrade php8.5-pgsqlUpgrade php8.5-odbcUpgrade php8.5-mbstring-debuginfoUpgrade php8.5-intl-debuginfoUpgrade php8.2-mysqlnd-debuginfoUpgrade php8.5-processUpgrade php8.5-commonUpgrade php8.4-snmpUpgrade php8.4-gmp-debuginfoUpgrade php8.2-sodium-debuginfoUpgrade php8.2-odbc-debuginfoUpgrade php8.3-mysqlnd-debuginfoUpgrade php8.3-pspell-debuginfoUpgrade php8.2-ldap-debuginfoUpgrade php8.4-soap-debuginfoUpgrade php8.4-xml-debuginfoUpgrade php8.4-process-debuginfoUpgrade php8.4-processUpgrade php8.4-enchant-debuginfoUpgrade php8.3-zipUpgrade php8.3-snmp-debuginfoUpgrade php8.3-process-debuginfoUpgrade php8.3-modphp-debuginfoUpgrade php8.3-fpmUpgrade php8.3-common-debuginfoUpgrade php8.2-tidy-debuginfoUpgrade php8.2-soapUpgrade php8.2-pspell-debuginfoUpgrade php8.2-gd-debuginfoUpgrade php8.2-bcmath-debuginfoUpgrade php8.2Upgrade php8.5-mbstringUpgrade php8.4-bcmath-debuginfoUpgrade php8.3-odbcUpgrade php8.3-cli-debuginfoUpgrade php8.3-bcmath-debuginfoUpgrade php8.4-odbcUpgrade php8.4-mbstring-debuginfoUpgrade php8.3-sodiumUpgrade php8.3-pdoUpgrade php8.3-enchantUpgrade php8.3-debugsourceUpgrade php8.2-xmlUpgrade php8.2-enchant-debuginfoUpgrade php8.2-commonUpgrade php8.5-fpm-debuginfoUpgrade php8.4-zip-debuginfoUpgrade php8.4-tidy-debuginfoUpgrade php8.3-tidy-debuginfoUpgrade php8.4-bcmathUpgrade php8.3-soapUpgrade php8.5-xmlUpgrade php8.5-intlUpgrade php8.4-snmp-debuginfoUpgrade php8.4-gd-debuginfoUpgrade php8.4-dbgUpgrade php8.2-dbaUpgrade php8.3-odbc-debuginfoUpgrade php8.2-ffi-debuginfoUpgrade php8.2-cliUpgrade php8.5-pdoUpgrade php8.2-ffiUpgrade php8.5-xml-debuginfoUpgrade php8.4-pgsqlUpgrade php8.4-pdo-debuginfo | Jul 21, 2026 | Jul 3, 2026 |
| Debian | — | Upgrade php8.2Upgrade php8.4 | Jul 5, 2026 | Jul 5, 2026 |
| Redhat_linux | — | Upgrade php-pecl-zip-debugsourceUpgrade php-bcmathUpgrade php8.4-fpm-debuginfoUpgrade php-json-debuginfoUpgrade php8.4-ldapUpgrade php-gd-debuginfoUpgrade php8.4-common-debuginfoUpgrade php-pecl-redis6Upgrade php8.4-dba-debuginfoUpgrade php-debugsourceUpgrade libzipUpgrade php-embedded-debuginfoUpgrade php8.4-opcache-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php8.4-bcmathUpgrade php8.4-mysqlnd-debuginfoUpgrade php-odbc-debuginfoUpgrade php-embeddedUpgrade php-ffi-debuginfoUpgrade php8.4-cli-debuginfoUpgrade php-pdo-debuginfoUpgrade php-enchant-debuginfoUpgrade php-gdUpgrade php-pecl-xdebug3-debugsourceUpgrade php-soapUpgrade php-pecl-apcu-debugsourceUpgrade php8.4-dbg-debuginfoUpgrade php-pecl-zipUpgrade php-xmlrpc-debuginfoUpgrade php-enchantUpgrade php8.4-soapUpgrade libzip-tools-debuginfoUpgrade php8.4-snmpUpgrade php-jsonUpgrade php8.4-pdo-debuginfoUpgrade php-develUpgrade php8.4-mbstring-debuginfoUpgrade php-fpmUpgrade php-pecl-xdebugUpgrade php8.4-intlUpgrade php8.4-intl-debuginfoUpgrade php8.4-fpmUpgrade php8.4-xmlUpgrade php-pecl-xdebug-debuginfoUpgrade php8.4-odbcUpgrade libzip-debuginfoUpgrade php-pecl-apcuUpgrade php-xmlUpgrade php-dbgUpgrade php-gmpUpgrade php-pearUpgrade php-pecl-xdebug3-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-gmp-debuginfoUpgrade php8.4-bcmath-debuginfoUpgrade php8.4-gd-debuginfoUpgrade phpUpgrade php-ldapUpgrade php-pecl-xdebug3Upgrade php-pecl-zip-debuginfoUpgrade php8.4-debugsourceUpgrade php-pdoUpgrade php8.4-embeddedUpgrade php8.4-gdUpgrade php-odbcUpgrade php-pecl-apcu-develUpgrade php8.4-cliUpgrade php8.4-ffiUpgrade php-commonUpgrade php8.4-mysqlndUpgrade php-intlUpgrade libzip-toolsUpgrade php-pecl-rrdUpgrade php-pecl-rrd-debugsourceUpgrade php8.4-dbaUpgrade php8.4-ffi-debuginfoUpgrade php-fpm-debuginfoUpgrade php-common-debuginfoUpgrade php-mysqlndUpgrade php-snmpUpgrade php8.4-ldap-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php8.4-xml-debuginfoUpgrade php-xml-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-ffiUpgrade php-dbg-debuginfoUpgrade php8.4-mbstringUpgrade php-opcache-debuginfoUpgrade php8.4-gmpUpgrade php-snmp-debuginfoUpgrade apcu-panelUpgrade php8.4-gmp-debuginfoUpgrade php8.4Upgrade php-process-debuginfoUpgrade php-pgsqlUpgrade php-processUpgrade php-intl-debuginfoUpgrade php-bcmath-debuginfoUpgrade php8.4-pdoUpgrade php-xmlrpcUpgrade php-soap-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php8.4-snmp-debuginfoUpgrade php8.4-pgsqlUpgrade php8.4-commonUpgrade php-mbstringUpgrade php-cli-debuginfoUpgrade php8.4-dbgUpgrade php8.4-processUpgrade php-opcacheUpgrade php8.4-pgsql-debuginfoUpgrade php-debuginfoUpgrade php8.4-embedded-debuginfoUpgrade php8.4-develUpgrade php8.4-enchant-debuginfoUpgrade php-pgsql-debuginfoUpgrade php8.4-enchantUpgrade php8.4-soap-debuginfoUpgrade php8.4-opcacheUpgrade libzip-develUpgrade php-cliUpgrade php8.4-process-debuginfoUpgrade php8.4-odbc-debuginfoUpgrade php8.4-debuginfoUpgrade php-pecl-redis6-debugsourceUpgrade php-dba-debuginfoUpgrade php-dbaUpgrade libzip-debugsourceUpgrade php-pecl-redis6-debuginfoUpgrade php-ldap-debuginfo | Aug 17, 2026 | Jul 3, 2026 |
| Rocky_linux | — | Upgrade libzipUpgrade php-enchantUpgrade php-pecl-xdebug3-debugsourceUpgrade php-ffi-debuginfoUpgrade php-common-debuginfoUpgrade php-enchant-debuginfoUpgrade php-dbgUpgrade php-pecl-xdebugUpgrade php-commonUpgrade php-bcmathUpgrade php-debugsourceUpgrade php-pecl-xdebug3-debuginfoUpgrade php-ldapUpgrade php-pecl-zipUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-apcuUpgrade php-embedded-debuginfoUpgrade php-embeddedUpgrade php-opcache-debuginfoUpgrade php-pecl-rrdUpgrade php-fpm-debuginfoUpgrade php-gdUpgrade php-pecl-rrd-debugsourceUpgrade php-xml-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-pdo-debuginfoUpgrade php-ldap-debuginfoUpgrade php-dbaUpgrade php-opcacheUpgrade php-cli-debuginfoUpgrade php-debuginfoUpgrade php-mysqlndUpgrade libzip-toolsUpgrade php-dbg-debuginfoUpgrade php-intlUpgrade php-snmp-debuginfoUpgrade php-process-debuginfoUpgrade php-fpmUpgrade php-gmpUpgrade php-pecl-redis6Upgrade php-develUpgrade php-pecl-zip-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-json-debuginfoUpgrade php-odbc-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pdoUpgrade php-gd-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-zip-debugsourceUpgrade php-odbcUpgrade php-pecl-xdebug3Upgrade php-pecl-xdebug-debuginfoUpgrade php-jsonUpgrade php-gmp-debuginfoUpgrade php-dba-debuginfoUpgrade php-cliUpgrade libzip-debuginfoUpgrade php-xml | Aug 17, 2026 | Aug 14, 2026 |
| Ubuntu | — | Upgrade php8.5Upgrade php8.3Upgrade php8.1 | Jul 21, 2026 | Jul 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub