In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.
CVSS Details
- CVSS 4.0 Base Score: 6.3 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-dbgUpgrade php-commonUpgrade libzip-toolsUpgrade php-xmlUpgrade php-mbstringUpgrade php-pearUpgrade libzip-develUpgrade php-xmlrpcUpgrade php-odbcUpgrade php-pecl-xdebugUpgrade php-pgsqlUpgrade php-snmpUpgrade php-gdUpgrade php-embeddedUpgrade php-pecl-zipUpgrade php-processUpgrade php-fpmUpgrade php-gmpUpgrade php-soapUpgrade php-pecl-rrdUpgrade apcu-panelUpgrade php-ldapUpgrade php-pecl-apcuUpgrade phpUpgrade php-ffiUpgrade php-dbaUpgrade php-enchantUpgrade php-jsonUpgrade php-bcmathUpgrade libzipUpgrade php-cliUpgrade php-pdoUpgrade php-opcacheUpgrade php-develUpgrade php-intlUpgrade php-pecl-xdebug3Upgrade php-pecl-redis6Upgrade php-pecl-apcu-develUpgrade php-mysqlnd | Jun 1, 2026 | Jun 1, 2026 |
| Alpine Linux | — | Upgrade php81Upgrade php84Upgrade php83Upgrade php85Upgrade php82 | May 15, 2026 | May 10, 2026 |
| Amazon Linux Ami 2 | — | Upgrade php-bcmathUpgrade php-snmpUpgrade php-develUpgrade php-xmlUpgrade phpUpgrade php-debuginfoUpgrade php-pgsqlUpgrade php-commonUpgrade php-ldapUpgrade php-intlUpgrade php-sodiumUpgrade php-dbgUpgrade php-odbcUpgrade php-fpmUpgrade php-mbstringUpgrade php-pspellUpgrade php-gdUpgrade php-opcacheUpgrade php-soapUpgrade php-cliUpgrade php-gmpUpgrade php-enchantUpgrade php-embeddedUpgrade php-pdoUpgrade php-processUpgrade php-mysqlndUpgrade php-dba | Jun 8, 2026 | Jun 8, 2026 |
| Amazon_linux_2023 | — | Upgrade php8.4-zipUpgrade php8.5-dbgUpgrade php8.4-xml-debuginfoUpgrade php8.5-mysqlnd-debuginfoUpgrade php8.2-gmpUpgrade php8.2-tidyUpgrade php8.2-mysqlnd-debuginfoUpgrade php8.2-pgsqlUpgrade php8.2-pspell-debuginfoUpgrade php8.3-opcache-debuginfoUpgrade php8.3-debuginfoUpgrade php8.3-mysqlnd-debuginfoUpgrade php8.5-embedded-debuginfoUpgrade php8.3-mysqlndUpgrade php8.3-debugsourceUpgrade php8.2-opcacheUpgrade php8.4-tidy-debuginfoUpgrade php8.2-process-debuginfoUpgrade php8.2-fpmUpgrade php8.2-gmp-debuginfoUpgrade php8.2-pspellUpgrade php8.4-ldap-debuginfoUpgrade php8.3-zipUpgrade php8.4-dba-debuginfoUpgrade php8.3-pgsql-debuginfoUpgrade php8.4-embedded-debuginfoUpgrade php8.3-gmp-debuginfoUpgrade php8.4-gmpUpgrade php8.4-opcache-debuginfoUpgrade php8.4-pdoUpgrade php8.5-bcmath-debuginfoUpgrade php8.5-dba-debuginfoUpgrade php8.4-pgsqlUpgrade php8.5-gd-debuginfoUpgrade php8.5-snmp-debuginfoUpgrade php8.2-embeddedUpgrade php8.2-commonUpgrade php8.2-intlUpgrade php8.2-dba-debuginfoUpgrade php8.2-dbg-debuginfoUpgrade php8.4-opcacheUpgrade php8.3-dbaUpgrade php8.5-odbc-debuginfoUpgrade php8.4-enchantUpgrade php8.4-zip-debuginfoUpgrade php8.5-gmp-debuginfoUpgrade php8.2-sodium-debuginfoUpgrade php8.3-ffiUpgrade php8.5-fpmUpgrade php8.3-intl-debuginfoUpgrade php8.5-gdUpgrade php8.3-ldapUpgrade php8.5-commonUpgrade php8.5-debugsourceUpgrade php8.4-tidyUpgrade php8.5-develUpgrade php8.3-process-debuginfoUpgrade php8.5-ldapUpgrade php8.2-dbgUpgrade php8.4-dbg-debuginfoUpgrade php8.5-ffiUpgrade php8.5-mysqlndUpgrade php8.4-sodium-debuginfoUpgrade php8.5-pgsql-debuginfoUpgrade php8.2-mbstring-debuginfoUpgrade php8.2-opcache-debuginfoUpgrade php8.4-odbcUpgrade php8.3-intlUpgrade php8.2-soapUpgrade php8.3-common-debuginfoUpgrade php8.5-sodiumUpgrade php8.2-common-debuginfoUpgrade php8.5-pgsqlUpgrade php8.5-soapUpgrade php8.2-mbstringUpgrade php8.3-pdo-debuginfoUpgrade php8.3-sodiumUpgrade php8.4-develUpgrade php8.3-processUpgrade php8.4-modphpUpgrade php8.2-develUpgrade php8.2-ldap-debuginfoUpgrade php8.3-fpmUpgrade php8.5-bcmathUpgrade php8.5-zipUpgrade php8.5-tidyUpgrade php8.5-enchant-debuginfoUpgrade php8.5-zip-debuginfoUpgrade php8.4-soap-debuginfoUpgrade php8.2-debugsourceUpgrade php8.2-xmlUpgrade php8.4Upgrade php8.2-soap-debuginfoUpgrade php8.3-snmpUpgrade php8.2-snmpUpgrade php8.3-dba-debuginfoUpgrade php8.2Upgrade php8.2-enchantUpgrade php8.2-pdoUpgrade php8.2-tidy-debuginfoUpgrade php8.3-zip-debuginfoUpgrade php8.4-process-debuginfoUpgrade php8.5-cliUpgrade php8.3-pdoUpgrade php8.4-mysqlndUpgrade php8.4-sodiumUpgrade php8.5-odbcUpgrade php8.5-soap-debuginfoUpgrade php8.3-enchant-debuginfoUpgrade php8.3-modphp-debuginfoUpgrade php8.3-commonUpgrade php8.3-xml-debuginfoUpgrade php8.2-cli-debuginfoUpgrade php8.2-embedded-debuginfoUpgrade php8.4-gmp-debuginfoUpgrade php8.4-mbstringUpgrade php8.4-enchant-debuginfoUpgrade php8.4-common-debuginfoUpgrade php8.4-dbgUpgrade php8.3-cli-debuginfoUpgrade php8.3-bcmathUpgrade php8.4-gd-debuginfoUpgrade php8.4-debugsourceUpgrade php8.2-cliUpgrade php8.5-xml-debuginfoUpgrade php8.5-snmpUpgrade php8.5-debuginfoUpgrade php8.4-fpmUpgrade php8.4-ldapUpgrade php8.3-ffi-debuginfoUpgrade php8.2-pgsql-debuginfoUpgrade php8.3-mbstringUpgrade php8.2-xml-debuginfoUpgrade php8.5-cli-debuginfoUpgrade php8.4-mbstring-debuginfoUpgrade php8.2-odbcUpgrade php8.2-dbaUpgrade php8.5-mbstring-debuginfoUpgrade php8.5-mbstringUpgrade php8.5-ffi-debuginfoUpgrade php8.5-embeddedUpgrade php8.5-dbaUpgrade php8.4-xmlUpgrade php8.3-odbc-debuginfoUpgrade php8.3-soapUpgrade php8.3-embeddedUpgrade php8.3Upgrade php8.2-processUpgrade php8.2-ffiUpgrade php8.2-debuginfoUpgrade php8.4-soapUpgrade php8.4-mysqlnd-debuginfoUpgrade php8.4-ffi-debuginfoUpgrade php8.4-bcmath-debuginfoUpgrade php8.2-gdUpgrade php8.4-fpm-debuginfoUpgrade php8.5-fpm-debuginfoUpgrade php8.4-pgsql-debuginfoUpgrade php8.4-pdo-debuginfoUpgrade php8.4-bcmathUpgrade php8.2-pdo-debuginfoUpgrade php8.2-gd-debuginfoUpgrade php8.2-enchant-debuginfoUpgrade php8.2-bcmath-debuginfoUpgrade php8.2-bcmathUpgrade php8.5-tidy-debuginfoUpgrade php8.3-mbstring-debuginfoUpgrade php8.3-enchantUpgrade php8.3-develUpgrade php8.5-dbg-debuginfoUpgrade php8.3-dbgUpgrade php8.4-snmp-debuginfoUpgrade php8.3-tidy-debuginfoUpgrade php8.3-tidyUpgrade php8.3-opcacheUpgrade php8.3-gdUpgrade php8.3-embedded-debuginfoUpgrade php8.2-mysqlndUpgrade php8.2-fpm-debuginfoUpgrade php8.5-pdoUpgrade php8.5-gmpUpgrade php8.4-gdUpgrade php8.3-pspell-debuginfoUpgrade php8.5-intlUpgrade php8.5-process-debuginfoUpgrade php8.3-sodium-debuginfoUpgrade php8.5-intl-debuginfoUpgrade php8.4-intlUpgrade php8.2-zipUpgrade php8.2-snmp-debuginfoUpgrade php8.3-soap-debuginfoUpgrade php8.2-ffi-debuginfoUpgrade php8.5-pdo-debuginfoUpgrade php8.3-cliUpgrade php8.5-modphp-debuginfoUpgrade php8.4-cliUpgrade php8.5-ldap-debuginfoUpgrade php8.4-processUpgrade php8.4-odbc-debuginfoUpgrade php8.4-ffiUpgrade php8.4-debuginfoUpgrade php8.3-bcmath-debuginfoUpgrade php8.2-zip-debuginfoUpgrade php8.2-sodiumUpgrade php8.2-intl-debuginfoUpgrade php8.5-processUpgrade php8.5-modphpUpgrade php8.5-enchantUpgrade php8.5-common-debuginfoUpgrade php8.3-dbg-debuginfoUpgrade php8.5-sodium-debuginfoUpgrade php8.4-commonUpgrade php8.3-pgsqlUpgrade php8.3-modphpUpgrade php8.3-ldap-debuginfoUpgrade php8.3-gd-debuginfoUpgrade php8.2-odbc-debuginfoUpgrade php8.2-ldapUpgrade php8.5-xmlUpgrade php8.5Upgrade php8.4-snmpUpgrade php8.4-intl-debuginfoUpgrade php8.4-embeddedUpgrade php8.4-dbaUpgrade php8.4-modphp-debuginfoUpgrade php8.3-odbcUpgrade php8.3-fpm-debuginfoUpgrade php8.3-snmp-debuginfoUpgrade php8.4-cli-debuginfoUpgrade php8.3-xmlUpgrade php8.3-pspellUpgrade php8.3-gmp | May 28, 2026 | May 10, 2026 |
| Debian | — | Upgrade php7.4Upgrade php8.4Upgrade php8.2 | May 10, 2026 | May 10, 2026 |
| Oracle_linux | — | Upgrade php-embeddedUpgrade php-mysqlndUpgrade libzip-toolsUpgrade php-pearUpgrade php-cliUpgrade php-gdUpgrade phpUpgrade php-xmlUpgrade libzip-develUpgrade apcu-panelUpgrade libzipUpgrade php-pecl-xdebug3Upgrade php-ldapUpgrade php-processUpgrade php-pecl-apcuUpgrade php-intlUpgrade php-snmpUpgrade php-pecl-rrdUpgrade php-opcacheUpgrade php-ffiUpgrade php-enchantUpgrade php-pecl-apcu-develUpgrade php-dbgUpgrade php-pdoUpgrade php-mbstringUpgrade php-bcmathUpgrade php-soapUpgrade php-odbcUpgrade php-develUpgrade php-gmpUpgrade php-pgsqlUpgrade php-pecl-zipUpgrade php-fpmUpgrade php-dbaUpgrade php-common | Jun 4, 2026 | May 10, 2026 |
| Redhat_linux | — | Upgrade php-dbgUpgrade php8.4-dba-debuginfoUpgrade php-dbaUpgrade php8.4-embedded-debuginfoUpgrade php-intlUpgrade php-json-debuginfoUpgrade php8.4-ldapUpgrade php8.4-embeddedUpgrade php8.4-mbstringUpgrade php-mbstring-debuginfoUpgrade php8.4-fpmUpgrade php8.4-snmp-debuginfoUpgrade php-pecl-xdebug3-debuginfoNo solution existsUpgrade php-gmp-debuginfoUpgrade php-soap-debuginfoUpgrade php-odbcUpgrade php-fpm-debuginfoUpgrade phpUpgrade php-cliUpgrade php-pecl-xdebug-debugsourceUpgrade php-process-debuginfoUpgrade php8.4-dbg-debuginfoUpgrade php8.4-cliUpgrade php8.4-cli-debuginfoUpgrade php8.4Upgrade php8.4-mysqlndUpgrade php8.4-soap-debuginfoUpgrade php8.4-intl-debuginfoUpgrade apcu-panelUpgrade php-embeddedUpgrade php-embedded-debuginfoUpgrade php-gdUpgrade php-pecl-redis6-debuginfoUpgrade php8.4-intlUpgrade libzipUpgrade libzip-debuginfoUpgrade libzip-debugsourceUpgrade php-bcmathUpgrade php-cli-debuginfoUpgrade php-enchant-debuginfoUpgrade php-enchantUpgrade php8.4-xmlUpgrade php-ffi-debuginfoUpgrade libzip-toolsUpgrade php-pecl-redis6Upgrade php-opcacheUpgrade php-ffiUpgrade php8.4-ffiUpgrade libzip-develUpgrade php-pecl-apcu-debugsourceUpgrade php8.4-debuginfoUpgrade php8.4-common-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-zip-debuginfoUpgrade php-mysqlndUpgrade php8.4-gd-debuginfoUpgrade php-pgsql-debuginfoUpgrade php8.4-ldap-debuginfoUpgrade php-snmpUpgrade php-bcmath-debuginfoUpgrade php8.4-pdoUpgrade php8.4-soapUpgrade php8.4-mysqlnd-debuginfoUpgrade php-debugsourceUpgrade php-ldapUpgrade php-pecl-apcuUpgrade php-pecl-zipUpgrade php8.4-enchantUpgrade php-gd-debuginfoUpgrade php-opcache-debuginfoUpgrade php8.4-pdo-debuginfoUpgrade php8.4-odbcUpgrade php-jsonUpgrade php8.4-enchant-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-soapUpgrade php8.4-pgsql-debuginfoUpgrade php-xmlUpgrade php8.4-gmpUpgrade php-mbstringUpgrade php-intl-debuginfoUpgrade php8.4-processUpgrade php8.4-opcacheUpgrade php8.4-develUpgrade php-fpmUpgrade php8.4-ffi-debuginfoUpgrade php-dbg-debuginfoUpgrade php8.4-process-debuginfoUpgrade php8.4-pgsqlUpgrade php8.4-debugsourceUpgrade php8.4-commonUpgrade php-pdoUpgrade php-commonUpgrade php8.4-snmpUpgrade php-ldap-debuginfoUpgrade php-pecl-redis6-debugsourceUpgrade php8.4-gdUpgrade php-snmp-debuginfoUpgrade libzip-tools-debuginfoUpgrade php8.4-fpm-debuginfoUpgrade php8.4-dbaUpgrade php-common-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php8.4-odbc-debuginfoUpgrade php-xmlrpcUpgrade php-pecl-apcu-debuginfoUpgrade php-pdo-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-rrd-debuginfoUpgrade php-debuginfoUpgrade php8.4-xml-debuginfoUpgrade php8.4-opcache-debuginfoUpgrade php8.4-bcmath-debuginfoUpgrade php-xml-debuginfoUpgrade php8.4-bcmathUpgrade php-odbc-debuginfoUpgrade php-pecl-xdebug3Upgrade php-pecl-xdebugUpgrade php-pgsqlUpgrade php8.4-mbstring-debuginfoUpgrade php-gmpUpgrade php-dba-debuginfoUpgrade php-pecl-apcu-develUpgrade php8.4-gmp-debuginfoUpgrade php8.4-dbgUpgrade php-processUpgrade php-pecl-rrdUpgrade php-develUpgrade php-pearUpgrade php-pecl-xdebug3-debugsource | Jun 3, 2026 | May 10, 2026 |
| Rocky_linux | — | Upgrade php-fpm-debuginfoUpgrade php-dba-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-develUpgrade php-pecl-xdebug-debugsourceUpgrade php-snmpUpgrade php-ffiUpgrade php-soap-debuginfoUpgrade php8.4-debuginfoUpgrade php8.4-snmpUpgrade libzip-debuginfoUpgrade php8.4-fpm-debuginfoUpgrade php-common-debuginfoUpgrade php8.4-pgsqlUpgrade php-pecl-xdebug3-debuginfoUpgrade php8.4-enchantUpgrade php-xml-debuginfoUpgrade php-pgsqlUpgrade php-pecl-redis6-debuginfoUpgrade php8.4-xmlUpgrade php8.4-odbc-debuginfoUpgrade php-bcmath-debuginfoUpgrade php8.4-cli-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php8.4-pgsql-debuginfoUpgrade libzip-develUpgrade php-debuginfoUpgrade php8.4-ffiUpgrade php-xmlUpgrade php-pecl-xdebugUpgrade php-opcache-debuginfoUpgrade php-ffi-debuginfoUpgrade php-enchant-debuginfoUpgrade php8.4-gmpUpgrade php-pecl-apcuUpgrade php-ldapUpgrade php-cliUpgrade php8.4-mysqlndUpgrade php8.4-enchant-debuginfoUpgrade php-pecl-xdebug3Upgrade php-pecl-apcu-debugsourceUpgrade php8.4-bcmath-debuginfoUpgrade php8.4-ldapUpgrade php8.4-ldap-debuginfoUpgrade php8.4-mysqlnd-debuginfoUpgrade php8.4-common-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-odbcUpgrade php-mbstring-debuginfoUpgrade php8.4-embedded-debuginfoUpgrade php-fpmUpgrade php-dbgUpgrade php8.4-gmp-debuginfoUpgrade php8.4-embeddedUpgrade php-mysqlnd-debuginfoUpgrade php8.4-soap-debuginfoUpgrade libzip-toolsUpgrade php8.4-snmp-debuginfoUpgrade php8.4-mbstringUpgrade php8.4-gdUpgrade php8.4-intl-debuginfoUpgrade php-json-debuginfoUpgrade php8.4-ffi-debuginfoUpgrade php-commonUpgrade php-intlUpgrade php-jsonUpgrade php-cli-debuginfoUpgrade php8.4-dbg-debuginfoUpgrade php8.4-commonUpgrade php8.4-intlUpgrade php-process-debuginfoUpgrade php8.4-process-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-gmp-debuginfoUpgrade libzip-debugsourceUpgrade php-dbg-debuginfoUpgrade php-dbaUpgrade php8.4-pdo-debuginfoUpgrade php8.4-bcmathUpgrade php-pecl-redis6-debugsourceUpgrade php8.4-xml-debuginfoUpgrade php8.4-cliUpgrade php-processUpgrade php-pecl-zipUpgrade php-pecl-rrdUpgrade php-pecl-apcu-develUpgrade php-mbstringUpgrade php-pecl-xdebug3-debugsourceUpgrade php-embedded-debuginfoUpgrade php8.4-dbaUpgrade php8.4Upgrade php-xmlrpc-debuginfoUpgrade php-pdo-debuginfoUpgrade php-odbc-debuginfoUpgrade php-mysqlndUpgrade php-gmpUpgrade php-embeddedUpgrade php-bcmathUpgrade php8.4-pdoUpgrade php8.4-odbcUpgrade php-soapUpgrade php8.4-develUpgrade php8.4-dba-debuginfoUpgrade php-xmlrpcUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-ldap-debuginfoUpgrade phpUpgrade libzipUpgrade php8.4-opcacheUpgrade php8.4-fpmUpgrade php-gdUpgrade php8.4-debugsourceUpgrade php8.4-dbgUpgrade php-gd-debuginfoUpgrade php8.4-mbstring-debuginfoUpgrade php-snmp-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pdoUpgrade php-opcacheUpgrade php8.4-processUpgrade php-intl-debuginfoUpgrade libzip-tools-debuginfoUpgrade php8.4-soapUpgrade php8.4-opcache-debuginfoUpgrade php-enchantUpgrade php-debugsourceUpgrade php8.4-gd-debuginfo | Jun 2, 2026 | Jun 1, 2026 |
| Ubuntu | — | Upgrade php8.4Upgrade php8.5Upgrade php8.3 | May 28, 2026 | May 10, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub