In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-xmlrpcUpgrade php-snmpUpgrade php-pecl-redis6Upgrade php-pdoUpgrade php-pecl-apcuUpgrade php-fpmUpgrade php-bcmathUpgrade php-pearUpgrade php-develUpgrade php-pecl-zipUpgrade php-gmpUpgrade php-cliUpgrade libzipUpgrade php-xmlUpgrade php-jsonUpgrade php-mbstringUpgrade php-pecl-xdebugUpgrade php-pecl-xdebug3Upgrade php-pgsqlUpgrade php-soapUpgrade php-intlUpgrade php-dbgUpgrade php-pecl-apcu-develUpgrade php-gdUpgrade apcu-panelUpgrade php-opcacheUpgrade php-enchantUpgrade libzip-develUpgrade php-processUpgrade php-odbcUpgrade libzip-toolsUpgrade php-embeddedUpgrade php-commonUpgrade php-ffiUpgrade php-ldapUpgrade php-pecl-rrdUpgrade php-mysqlndUpgrade phpUpgrade php-dba | Feb 2, 2026 | Jan 27, 2026 |
| Alpine Linux | — | Upgrade php81Upgrade php83Upgrade php85Upgrade php84Upgrade php82 | Jan 5, 2026 | Dec 27, 2025 |
| Amazon Linux Ami 2 | — | Upgrade php-odbcUpgrade php-dbaUpgrade php-debuginfoUpgrade php-snmpUpgrade php-embeddedUpgrade php-mysqlndUpgrade php-cliUpgrade php-gdUpgrade php-opcacheUpgrade php-sodiumUpgrade phpUpgrade php-dbgUpgrade php-intlUpgrade php-enchantUpgrade php-ldapUpgrade php-processUpgrade php-pdoUpgrade php-bcmathUpgrade php-gmpUpgrade php-pspellUpgrade php-develUpgrade php-xmlUpgrade php-mbstringUpgrade php-commonUpgrade php-soapUpgrade php-pgsqlUpgrade php-fpm | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade php8.2-dba-debuginfoUpgrade php8.3-intl-debuginfoUpgrade php8.4-modphpUpgrade php8.4-mysqlndUpgrade php8.2-pdo-debuginfoUpgrade php8.2-tidy-debuginfoUpgrade php8.4-pgsqlUpgrade php8.1-bcmath-debuginfoUpgrade php8.2-cli-debuginfoUpgrade php8.4-soapUpgrade php8.4-tidyUpgrade php8.4-common-debuginfoUpgrade php8.1Upgrade php8.3-pdo-debuginfoUpgrade php8.1-tidy-debuginfoUpgrade php8.2-commonUpgrade php8.1-opcacheUpgrade php8.2-develUpgrade php8.2-mbstring-debuginfoUpgrade php8.1-pspellUpgrade php8.2-gmp-debuginfoUpgrade php8.2-snmp-debuginfoUpgrade php8.4-opcacheUpgrade php8.4-pdoUpgrade php8.4-embeddedUpgrade php8.1-develUpgrade php8.3-processUpgrade php8.3-xml-debuginfoUpgrade php8.1-gdUpgrade php8.3-embedded-debuginfoUpgrade php8.1-intl-debuginfoUpgrade php8.1-soapUpgrade php8.4-cli-debuginfoUpgrade php8.2-dbgUpgrade php8.3-fpmUpgrade php8.4-opcache-debuginfoUpgrade php8.4-zip-debuginfoUpgrade php8.2-fpmUpgrade php8.2-enchantUpgrade php8.3-mbstring-debuginfoUpgrade php8.4-tidy-debuginfoUpgrade php8.4-develUpgrade php8.2-pdoUpgrade php8.4-odbc-debuginfoUpgrade php8.2-intlUpgrade php8.3-commonUpgrade php8.2-common-debuginfoUpgrade php8.3-opcache-debuginfoUpgrade php8.3-gmp-debuginfoUpgrade php8.3-pgsql-debuginfoUpgrade php8.3-embeddedUpgrade php8.3-ffi-debuginfoUpgrade php8.3-enchant-debuginfoUpgrade php8.4-embedded-debuginfoUpgrade php8.3-pspellUpgrade php8.3-debuginfoUpgrade php8.3-dbaUpgrade php8.3-debugsourceUpgrade php8.3-mbstringUpgrade php8.4-fpmUpgrade php8.2-ldap-debuginfoUpgrade php8.2-opcacheUpgrade php8.1-intlUpgrade php8.2-soap-debuginfoUpgrade php8.1-gd-debuginfoUpgrade php8.3Upgrade php8.4-sodium-debuginfoUpgrade php8.1-bcmathUpgrade php8.4-cliUpgrade php8.3-zipUpgrade php8.2-mysqlnd-debuginfoUpgrade php8.3-fpm-debuginfoUpgrade php8.2-debuginfoUpgrade php8.2-soapUpgrade php8.3-modphp-debuginfoUpgrade php8.1-fpm-debuginfoUpgrade php8.1-dbg-debuginfoUpgrade php8.4-fpm-debuginfoUpgrade php8.4Upgrade php8.4-gmpUpgrade php8.4-ldap-debuginfoUpgrade php8.4-intl-debuginfoUpgrade php8.4-sodiumUpgrade php8.2-mbstringUpgrade php8.3-snmpUpgrade php8.3-gmpUpgrade php8.1-cli-debuginfoUpgrade php8.1-odbc-debuginfoUpgrade php8.4-mbstringUpgrade php8.2-embeddedUpgrade php8.1-debuginfoUpgrade php8.1-enchant-debuginfoUpgrade php8.2-embedded-debuginfoUpgrade php8.4-enchant-debuginfoUpgrade php8.2-pgsqlUpgrade php8.2-sodium-debuginfoUpgrade php8.2-enchant-debuginfoUpgrade php8.1-opcache-debuginfoUpgrade php8.1-pdoUpgrade php8.2-bcmathUpgrade php8.4-process-debuginfoUpgrade php8.1-debugsourceUpgrade php8.4-odbcUpgrade php8.1-mbstringUpgrade php8.1-pgsql-debuginfoUpgrade php8.1-mbstring-debuginfoUpgrade php8.4-bcmath-debuginfoUpgrade php8.3-dbgUpgrade php8.4-dba-debuginfoUpgrade php8.2-fpm-debuginfoUpgrade php8.1-mysqlnd-debuginfoUpgrade php8.1-embeddedUpgrade php8.4-processUpgrade php8.4-modphp-debuginfoUpgrade php8.4-mbstring-debuginfoUpgrade php8.4-debugsourceUpgrade php8.3-odbcUpgrade php8.2-zipUpgrade php8.4-xml-debuginfoUpgrade php8.4-bcmathUpgrade php8.1-enchantUpgrade php8.1-pspell-debuginfoUpgrade php8.2-xml-debuginfoUpgrade php8.2-ffiUpgrade php8.1-process-debuginfoUpgrade php8.1-ldap-debuginfoUpgrade php8.4-snmpUpgrade php8.4-intlUpgrade php8.3-sodium-debuginfoUpgrade php8.3-common-debuginfoUpgrade php8.3-cliUpgrade php8.3-ldapUpgrade php8.3-tidyUpgrade php8.3-sodiumUpgrade php8.3-ldap-debuginfoUpgrade php8.3-ffiUpgrade php8.2-odbc-debuginfoUpgrade php8.1-xmlUpgrade php8.1-processUpgrade php8.1-fpmUpgrade php8.1-mysqlndUpgrade php8.3-dba-debuginfoUpgrade php8.2-zip-debuginfoUpgrade php8.4-dbaUpgrade php8.1-zip-debuginfoUpgrade php8.3-soapUpgrade php8.2-pspell-debuginfoUpgrade php8.2-pgsql-debuginfoUpgrade php8.2-odbcUpgrade php8.1-xml-debuginfoUpgrade php8.4-dbg-debuginfoUpgrade php8.4-dbgUpgrade php8.2-debugsourceUpgrade php8.1-zipUpgrade php8.2-pspellUpgrade php8.4-ldapUpgrade php8.3-odbc-debuginfoUpgrade php8.4-mysqlnd-debuginfoUpgrade php8.3-tidy-debuginfoUpgrade php8.3-soap-debuginfoUpgrade php8.3-opcacheUpgrade php8.3-gd-debuginfoUpgrade php8.3-gdUpgrade php8.3-enchantUpgrade php8.2-tidyUpgrade php8.2-sodiumUpgrade php8.2-process-debuginfoUpgrade php8.2-gmpUpgrade php8.2-gd-debuginfoUpgrade php8.1-tidyUpgrade php8.1-soap-debuginfoUpgrade php8.4-pgsql-debuginfoUpgrade php8.3-bcmathUpgrade php8.4-ffiUpgrade php8.3-process-debuginfoUpgrade php8.3-modphpUpgrade php8.1-gmpUpgrade php8.1-cliUpgrade php8.4-zipUpgrade php8.3-dbg-debuginfoUpgrade php8.1-odbcUpgrade php8.1-dbaUpgrade php8.4-ffi-debuginfoUpgrade php8.4-enchantUpgrade php8.2Upgrade php8.1-dbgUpgrade php8.1-dba-debuginfoUpgrade php8.1-ffi-debuginfoUpgrade php8.3-zip-debuginfoUpgrade php8.3-mysqlndUpgrade php8.2-dbg-debuginfoUpgrade php8.2-ffi-debuginfoUpgrade php8.1-embedded-debuginfoUpgrade php8.3-pgsqlUpgrade php8.3-pdoUpgrade php8.2-processUpgrade php8.2-intl-debuginfoUpgrade php8.2-gdUpgrade php8.2-cliUpgrade php8.4-xmlUpgrade php8.4-soap-debuginfoUpgrade php8.4-snmp-debuginfoUpgrade php8.4-pdo-debuginfoUpgrade php8.4-gmp-debuginfoUpgrade php8.3-snmp-debuginfoUpgrade php8.3-develUpgrade php8.3-bcmath-debuginfoUpgrade php8.2-snmpUpgrade php8.2-dbaUpgrade php8.1-snmp-debuginfoUpgrade php8.1-snmpUpgrade php8.3-intlUpgrade php8.4-gd-debuginfoUpgrade php8.1-ldapUpgrade php8.1-pdo-debuginfoUpgrade php8.2-bcmath-debuginfoUpgrade php8.1-gmp-debuginfoUpgrade php8.1-ffiUpgrade php8.1-common-debuginfoUpgrade php8.1-commonUpgrade php8.4-gdUpgrade php8.4-debuginfoUpgrade php8.4-commonUpgrade php8.3-xmlUpgrade php8.3-pspell-debuginfoUpgrade php8.3-mysqlnd-debuginfoUpgrade php8.3-cli-debuginfoUpgrade php8.2-ldapUpgrade php8.2-opcache-debuginfoUpgrade php8.2-mysqlndUpgrade php8.2-xmlUpgrade php8.1-pgsql | Jan 12, 2026 | Dec 27, 2025 |
| Debian | — | Upgrade php8.2Upgrade php8.4Upgrade php7.4 | Jan 26, 2026 | Jan 26, 2026 |
| Oracle_linux | — | Upgrade php-pgsqlUpgrade php-ffiUpgrade php-xmlUpgrade php-commonUpgrade php-odbcUpgrade libzip-toolsUpgrade php-snmpUpgrade php-mbstringUpgrade libzip-develUpgrade php-processUpgrade php-cliUpgrade php-pecl-rrdUpgrade php-xmlrpcUpgrade php-fpmUpgrade apcu-panelUpgrade php-pecl-xdebugUpgrade php-intlUpgrade php-ldapUpgrade php-embeddedUpgrade libzipUpgrade php-develUpgrade php-pecl-redis6Upgrade php-dbgUpgrade php-opcacheUpgrade php-jsonUpgrade php-pdoUpgrade php-bcmathUpgrade php-enchantUpgrade php-pecl-apcu-develUpgrade php-dbaUpgrade php-gmpUpgrade php-pecl-zipUpgrade php-mysqlndUpgrade php-gdUpgrade php-pearUpgrade php-pecl-apcuUpgrade php-pecl-xdebug3Upgrade phpUpgrade php-soap | Jan 29, 2026 | Dec 27, 2025 |
| Redhat_linux | — | Upgrade php-pecl-xdebug3-debuginfoUpgrade php-pecl-redis6-debuginfoUpgrade php-fpm-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-xdebug3Upgrade libzip-develUpgrade php-ffi-debuginfoUpgrade php-commonUpgrade php-pearUpgrade php-pecl-apcu-debugsourceUpgrade php-ldapUpgrade php-pgsql-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-mysqlndUpgrade php-dbgUpgrade php-xmlUpgrade php-debuginfoUpgrade php-odbcUpgrade php-common-debuginfoUpgrade php-pgsqlUpgrade php-soap-debuginfoUpgrade php-json-debuginfoUpgrade php-fpmUpgrade php-enchant-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-apcuUpgrade php-xml-debuginfoUpgrade php-dba-debuginfoUpgrade php-cliUpgrade php-pecl-redis6Upgrade php-mbstring-debuginfoUpgrade php-develUpgrade php-pecl-xdebugUpgrade php-opcacheUpgrade php-snmpUpgrade php-pecl-rrd-debugsourceUpgrade libzip-debuginfoUpgrade php-xmlrpcUpgrade php-dbaUpgrade php-pecl-redis6-debugsourceUpgrade php-pecl-xdebug3-debugsourceUpgrade php-processUpgrade php-bcmathUpgrade php-odbc-debuginfoUpgrade libzipUpgrade php-gdUpgrade libzip-tools-debuginfoUpgrade php-ffiUpgrade php-enchantUpgrade php-cli-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-process-debuginfoUpgrade php-snmp-debuginfoUpgrade php-mbstringUpgrade php-gmp-debuginfoUpgrade php-soapUpgrade php-gd-debuginfoUpgrade php-pdo-debuginfoUpgrade php-embedded-debuginfoUpgrade php-pecl-zipUpgrade php-jsonUpgrade php-intl-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade apcu-panelUpgrade php-pecl-rrd-debuginfoUpgrade php-opcache-debuginfoUpgrade php-gmpUpgrade phpUpgrade php-dbg-debuginfoUpgrade php-pdoUpgrade libzip-debugsourceUpgrade php-ldap-debuginfoUpgrade php-intlUpgrade php-pecl-apcu-debuginfoUpgrade php-embeddedUpgrade libzip-toolsUpgrade php-debugsourceUpgrade php-bcmath-debuginfoUpgrade php-pecl-rrdUpgrade php-pecl-apcu-devel | Jan 27, 2026 | Dec 27, 2025 |
| Rocky_linux | — | Upgrade php-pecl-xdebug3-debugsourceUpgrade php-pecl-apcu-develUpgrade php-fpm-debuginfoUpgrade php-opcacheUpgrade php-processUpgrade php-debugsourceUpgrade php-pdo-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-fpmUpgrade php-mysqlndUpgrade php-enchant-debuginfoUpgrade php-develUpgrade php-pecl-redis6-debugsourceUpgrade libzip-tools-debuginfoUpgrade php-enchantUpgrade php-embedded-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-pecl-apcuUpgrade php-soapUpgrade php-ffi-debuginfoUpgrade php-embeddedUpgrade php-gdUpgrade libzipUpgrade php-process-debuginfoUpgrade php-dbg-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-intlUpgrade php-odbc-debuginfoUpgrade php-gmpUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-rrdUpgrade php-jsonUpgrade php-gd-debuginfoUpgrade php-pecl-xdebug3-debuginfoUpgrade phpUpgrade php-pecl-zipUpgrade php-pecl-zip-debugsourceUpgrade php-pgsql-debuginfoUpgrade php-cli-debuginfoUpgrade php-gmp-debuginfoUpgrade libzip-debugsourceUpgrade php-bcmathUpgrade php-pdoUpgrade php-pecl-xdebug3Upgrade php-ldapUpgrade php-dbaUpgrade php-debuginfoUpgrade libzip-develUpgrade php-xmlUpgrade php-pgsqlUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-redis6Upgrade php-commonUpgrade php-odbcUpgrade php-common-debuginfoUpgrade php-ldap-debuginfoUpgrade php-mbstring-debuginfoUpgrade libzip-debuginfoUpgrade php-soap-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-json-debuginfoUpgrade libzip-toolsUpgrade php-pecl-redis6-debuginfoUpgrade php-cliUpgrade php-pecl-rrd-debuginfoUpgrade php-ffiUpgrade php-dba-debuginfoUpgrade php-opcache-debuginfoUpgrade php-snmpUpgrade php-mbstringUpgrade php-dbgUpgrade php-xml-debuginfoUpgrade php-intl-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-xmlrpcUpgrade php-snmp-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-xdebugUpgrade php-pecl-zip-debuginfo | Jan 29, 2026 | Jan 28, 2026 |
| Ubuntu | — | Upgrade php8.3Upgrade php8.4Upgrade php8.1Upgrade php7.2 (Ubuntu Pro)Upgrade php7.4 (Ubuntu Pro) | Jan 13, 2026 | Dec 27, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub