In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.
CVSS Details
- CVSS 4.0 Base Score: 6.3 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-pgsqlUpgrade php-dbgUpgrade php-xmlUpgrade php-xmlrpcUpgrade php-commonUpgrade php-odbcUpgrade libzip-toolsUpgrade php-snmpUpgrade libzip-develUpgrade php-mbstringUpgrade php-pearUpgrade php-pecl-xdebugUpgrade php-develUpgrade php-intlUpgrade php-bcmathUpgrade php-opcacheUpgrade php-pecl-xdebug3Upgrade php-processUpgrade php-fpmUpgrade libzipUpgrade php-pdoUpgrade php-cliUpgrade php-embeddedUpgrade php-gdUpgrade php-pecl-apcu-develUpgrade php-mysqlndUpgrade php-pecl-redis6Upgrade php-pecl-zipUpgrade phpUpgrade apcu-panelUpgrade php-jsonUpgrade php-enchantUpgrade php-dbaUpgrade php-ffiUpgrade php-pecl-rrdUpgrade php-ldapUpgrade php-soapUpgrade php-gmpUpgrade php-pecl-apcu | Jun 1, 2026 | Jun 1, 2026 |
| Alpine Linux | — | Upgrade php82Upgrade php84Upgrade php85Upgrade php83Upgrade php81 | May 15, 2026 | May 10, 2026 |
| Amazon Linux Ami 2 | — | Upgrade php-intlUpgrade php-sodiumUpgrade php-develUpgrade php-debuginfoUpgrade phpUpgrade php-commonUpgrade php-pgsqlUpgrade php-bcmathUpgrade php-snmpUpgrade php-dbgUpgrade php-xmlUpgrade php-fpmUpgrade php-odbcUpgrade php-ldapUpgrade php-gdUpgrade php-cliUpgrade php-pspellUpgrade php-opcacheUpgrade php-mysqlndUpgrade php-mbstringUpgrade php-embeddedUpgrade php-gmpUpgrade php-enchantUpgrade php-pdoUpgrade php-soapUpgrade php-dbaUpgrade php-process | Jun 8, 2026 | Jun 8, 2026 |
| Amazon_linux_2023 | — | Upgrade php8.3-intl-debuginfoUpgrade php8.3-ffiUpgrade php8.2-tidyUpgrade php8.4-opcacheUpgrade php8.4-gmpUpgrade php8.4-embedded-debuginfoUpgrade php8.4-ldap-debuginfoUpgrade php8.3-process-debuginfoUpgrade php8.5-gdUpgrade php8.4-enchantUpgrade php8.2-intlUpgrade php8.2-embeddedUpgrade php8.2-commonUpgrade php8.3-ldapUpgrade php8.5-commonUpgrade php8.2-dbgUpgrade php8.5-debugsourceUpgrade php8.4-tidyUpgrade php8.5-develUpgrade php8.5-soapUpgrade php8.5-pgsqlUpgrade php8.4-modphpUpgrade php8.4-develUpgrade php8.3-sodiumUpgrade php8.3-processUpgrade php8.3-fpmUpgrade php8.2-xmlUpgrade php8.2-ldap-debuginfoUpgrade php8.2-develUpgrade php8.2-debugsourceUpgrade php8.3-intlUpgrade php8.3-pdo-debuginfoUpgrade php8.4-common-debuginfoUpgrade php8.4Upgrade php8.3-common-debuginfoUpgrade php8.2-soapUpgrade php8.2-opcache-debuginfoUpgrade php8.2-mbstring-debuginfoUpgrade php8.2-mbstringUpgrade php8.2-common-debuginfoUpgrade php8.5-pgsql-debuginfoUpgrade php8.5-mysqlndUpgrade php8.5-ffiUpgrade php8.4-sodium-debuginfoUpgrade php8.4-odbcUpgrade php8.4-dbg-debuginfoUpgrade php8.5-tidyUpgrade php8.5-bcmathUpgrade php8.5-zip-debuginfoUpgrade php8.5-sodiumUpgrade php8.2-pdoUpgrade php8.2-enchantUpgrade php8.5-odbcUpgrade php8.5-enchant-debuginfoUpgrade php8.4-soap-debuginfoUpgrade php8.5-soap-debuginfoUpgrade php8.3-dba-debuginfoUpgrade php8.5-zipUpgrade php8.4-enchant-debuginfoUpgrade php8.3-pdoUpgrade php8.2-tidy-debuginfoUpgrade php8.2-soap-debuginfoUpgrade php8.2Upgrade php8.3-snmpUpgrade php8.2-snmpUpgrade php8.5-ldapUpgrade php8.5-embedded-debuginfoUpgrade php8.5-dbgUpgrade php8.4-zipUpgrade php8.4-xml-debuginfoUpgrade php8.2-pspell-debuginfoUpgrade php8.2-pgsqlUpgrade php8.2-mysqlnd-debuginfoUpgrade php8.5-mysqlnd-debuginfoUpgrade php8.3-opcache-debuginfoUpgrade php8.3-mysqlnd-debuginfoUpgrade php8.3-mysqlndUpgrade php8.3-debuginfoUpgrade php8.2-gmpUpgrade php8.4-gmp-debuginfoUpgrade php8.4-mbstringUpgrade php8.3-commonUpgrade php8.2-sodium-debuginfoUpgrade php8.2-dbg-debuginfoUpgrade php8.2-dba-debuginfoUpgrade php8.5-fpmUpgrade php8.5-cliUpgrade php8.4-zip-debuginfoUpgrade php8.4-sodiumUpgrade php8.4-process-debuginfoUpgrade php8.4-mysqlndUpgrade php8.3-zip-debuginfoUpgrade php8.3-xml-debuginfoUpgrade php8.3-modphp-debuginfoUpgrade php8.3-enchant-debuginfoUpgrade php8.3-dbaUpgrade php8.2-cli-debuginfoUpgrade php8.2-embedded-debuginfoUpgrade php8.5-gmp-debuginfoUpgrade php8.3-debugsourceUpgrade php8.2-pspellUpgrade php8.4-dba-debuginfoUpgrade php8.3-zipUpgrade php8.3-pgsql-debuginfoUpgrade php8.3-gmp-debuginfoUpgrade php8.2-process-debuginfoUpgrade php8.2-opcacheUpgrade php8.2-gmp-debuginfoUpgrade php8.2-fpmUpgrade php8.5-snmp-debuginfoUpgrade php8.5-odbc-debuginfoUpgrade php8.5-gd-debuginfoUpgrade php8.5-dba-debuginfoUpgrade php8.5-bcmath-debuginfoUpgrade php8.4-tidy-debuginfoUpgrade php8.4-pgsqlUpgrade php8.4-pdoUpgrade php8.4-opcache-debuginfoUpgrade php8.3-opcacheUpgrade php8.3-pspell-debuginfoUpgrade php8.4-ffiUpgrade php8.5-pdoUpgrade php8.3-tidyUpgrade php8.3-tidy-debuginfoUpgrade php8.4-gdUpgrade php8.3-snmp-debuginfoUpgrade php8.5-mbstring-debuginfoUpgrade php8.3-odbcUpgrade php8.2-dbaUpgrade php8.4-fpmUpgrade php8.4-cli-debuginfoUpgrade php8.2-mysqlndUpgrade php8.4-debuginfoUpgrade php8.3-cli-debuginfoUpgrade php8.3-gmpUpgrade php8.3-ffi-debuginfoUpgrade php8.3-pspellUpgrade php8.5-debuginfoUpgrade php8.3-bcmathUpgrade php8.3-xmlUpgrade php8.4-odbc-debuginfoUpgrade php8.5-snmpUpgrade php8.5-xml-debuginfoUpgrade php8.2-cliUpgrade php8.5-gmpUpgrade php8.5-intl-debuginfoUpgrade php8.2-fpm-debuginfoUpgrade php8.4-ldapUpgrade php8.5-processUpgrade php8.2-intl-debuginfoUpgrade php8.3-dbgUpgrade php8.5-dbg-debuginfoUpgrade php8.3-gdUpgrade php8.4-mbstring-debuginfoUpgrade php8.3-modphpUpgrade php8.2-ldapUpgrade php8.5-ffi-debuginfoUpgrade php8.3-pgsqlUpgrade php8.4-cliUpgrade php8.4-commonUpgrade php8.4-dbaUpgrade php8.3-gd-debuginfoUpgrade php8.2-odbc-debuginfoUpgrade php8.5-ldap-debuginfoUpgrade php8.5-sodium-debuginfoUpgrade php8.4-snmpUpgrade php8.5-xmlUpgrade php8.4-embeddedUpgrade php8.4-modphp-debuginfoUpgrade php8.3-fpm-debuginfoUpgrade php8.3-dbg-debuginfoUpgrade php8.3-ldap-debuginfoUpgrade php8.2-processUpgrade php8.4-intl-debuginfoUpgrade php8.2-xml-debuginfoUpgrade php8.5Upgrade php8.3-mbstringUpgrade php8.5-cli-debuginfoUpgrade php8.5-dbaUpgrade php8.5-embeddedUpgrade php8.5-mbstringUpgrade php8.4-bcmath-debuginfoUpgrade php8.4-ffi-debuginfoUpgrade php8.4-fpm-debuginfoUpgrade php8.3-odbc-debuginfoUpgrade php8.3Upgrade php8.3-embeddedUpgrade php8.4-dbgUpgrade php8.4-debugsourceUpgrade php8.3-soapUpgrade php8.4-gd-debuginfoUpgrade php8.4-intlUpgrade php8.2-odbcUpgrade php8.2-debuginfoUpgrade php8.4-mysqlnd-debuginfoUpgrade php8.4-snmp-debuginfoUpgrade php8.3-embedded-debuginfoUpgrade php8.2-pgsql-debuginfoUpgrade php8.4-processUpgrade php8.4-soapUpgrade php8.2-gdUpgrade php8.5-common-debuginfoUpgrade php8.5-enchantUpgrade php8.4-xmlUpgrade php8.2-ffiUpgrade php8.5-modphpUpgrade php8.4-pgsql-debuginfoUpgrade php8.5-modphp-debuginfoUpgrade php8.4-bcmathUpgrade php8.4-pdo-debuginfoUpgrade php8.5-fpm-debuginfoUpgrade php8.3-mbstring-debuginfoUpgrade php8.3-sodium-debuginfoUpgrade php8.2-zip-debuginfoUpgrade php8.5-intlUpgrade php8.2-sodiumUpgrade php8.3-develUpgrade php8.5-process-debuginfoUpgrade php8.5-tidy-debuginfoUpgrade php8.2-pdo-debuginfoUpgrade php8.3-enchantUpgrade php8.3-bcmath-debuginfoUpgrade php8.2-bcmathUpgrade php8.2-gd-debuginfoUpgrade php8.2-bcmath-debuginfoUpgrade php8.2-enchant-debuginfoUpgrade php8.3-soap-debuginfoUpgrade php8.5-pdo-debuginfoUpgrade php8.3-cliUpgrade php8.2-ffi-debuginfoUpgrade php8.2-zipUpgrade php8.2-snmp-debuginfo | May 28, 2026 | May 10, 2026 |
| Debian | — | Upgrade php8.4Upgrade php7.4Upgrade php8.2 | May 10, 2026 | May 10, 2026 |
| Oracle_linux | — | Upgrade libzipUpgrade apcu-panelUpgrade php-ffiUpgrade php-embeddedUpgrade php-enchantUpgrade php-ldapUpgrade php-pecl-rrdUpgrade php-processUpgrade libzip-develUpgrade php-gdUpgrade phpUpgrade php-pearUpgrade php-mysqlndUpgrade php-cliUpgrade php-intlUpgrade php-snmpUpgrade php-pecl-apcuUpgrade libzip-toolsUpgrade php-pecl-xdebug3Upgrade php-xmlUpgrade php-opcacheUpgrade php-develUpgrade php-pdoUpgrade php-odbcUpgrade php-fpmUpgrade php-dbaUpgrade php-commonUpgrade php-soapUpgrade php-pgsqlUpgrade php-pecl-zipUpgrade php-gmpUpgrade php-dbgUpgrade php-bcmathUpgrade php-mbstringUpgrade php-pecl-apcu-devel | Jun 4, 2026 | May 10, 2026 |
| Redhat_linux | — | Upgrade php-dba-debuginfoUpgrade php8.4-gdUpgrade php-pecl-redis6-debugsourceUpgrade php-jsonUpgrade php-opcache-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-common-debuginfoUpgrade php-soapUpgrade php-xmlrpcUpgrade php-xml-debuginfoUpgrade php-pecl-xdebug3-debugsourceUpgrade php8.4-fpm-debuginfoUpgrade php-pearUpgrade php-develUpgrade php-snmp-debuginfoUpgrade php8.4-gmp-debuginfoUpgrade php8.4-pdo-debuginfoUpgrade php8.4-dbaUpgrade php8.4-opcacheUpgrade php8.4-opcache-debuginfoUpgrade php8.4-snmpUpgrade libzip-tools-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pecl-xdebug3Upgrade php-mbstringUpgrade php8.4-gmpUpgrade php-processUpgrade php-xmlUpgrade php8.4-processUpgrade php8.4-odbcUpgrade php-intl-debuginfoUpgrade php-gmpUpgrade php-debuginfoUpgrade php-pdo-debuginfoUpgrade php8.4-bcmath-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-ldap-debuginfoUpgrade php8.4-pgsqlUpgrade php8.4-enchant-debuginfoUpgrade php8.4-mbstring-debuginfoUpgrade php-pdoUpgrade php8.4-commonUpgrade php-pecl-rrdUpgrade php8.4-debugsourceUpgrade php8.4-ffi-debuginfoUpgrade php8.4-bcmathUpgrade php8.4-dbgUpgrade php8.4-process-debuginfoUpgrade php8.4-xml-debuginfoUpgrade php-odbc-debuginfoUpgrade php8.4-odbc-debuginfoUpgrade php-pgsqlUpgrade php-pecl-zip-debugsourceUpgrade php8.4-pgsql-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-dbg-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php8.4-develUpgrade php-pecl-xdebugUpgrade php-commonUpgrade php-fpmUpgrade php-embeddedUpgrade php8.4-pdoUpgrade php8.4-cliUpgrade php8.4-embedded-debuginfoUpgrade php8.4-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-embedded-debuginfoUpgrade php8.4-snmp-debuginfoUpgrade php8.4-ldapUpgrade php-ffiUpgrade php-pecl-redis6Upgrade php-opcacheUpgrade php-enchantUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-mysqlndUpgrade libzip-develUpgrade php-snmpUpgrade php-pgsql-debuginfoUpgrade php8.4-soapUpgrade php8.4-common-debuginfoUpgrade php-odbcUpgrade php-gd-debuginfoUpgrade php8.4-mysqlnd-debuginfoUpgrade php-fpm-debuginfoUpgrade php-ldapUpgrade php8.4-enchantUpgrade php-pecl-apcuUpgrade php8.4-cli-debuginfoUpgrade php8.4-intlUpgrade php-gdUpgrade php8.4-dbg-debuginfoUpgrade php8.4-xmlUpgrade php-process-debuginfoUpgrade php-cli-debuginfoUpgrade php-pecl-redis6-debuginfoUpgrade php-enchant-debuginfoUpgrade libzip-debuginfoUpgrade php-bcmathUpgrade php-debugsourceUpgrade php-ffi-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-cliUpgrade libzip-debugsourceUpgrade phpUpgrade php8.4-gd-debuginfoUpgrade php-bcmath-debuginfoUpgrade php8.4-ldap-debuginfoUpgrade libzip-toolsUpgrade libzipUpgrade php-pecl-zipUpgrade php8.4-mbstringNo solution existsUpgrade php8.4-intl-debuginfoUpgrade php8.4Upgrade php-gmp-debuginfoUpgrade php8.4-mysqlndUpgrade php-soap-debuginfoUpgrade php-pecl-xdebug3-debuginfoUpgrade apcu-panelUpgrade php8.4-soap-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php8.4-embeddedUpgrade php-dbgUpgrade php8.4-ffiUpgrade php-dbaUpgrade php8.4-dba-debuginfoUpgrade php8.4-fpmUpgrade php-intlUpgrade php-json-debuginfo | Jun 3, 2026 | May 10, 2026 |
| Rocky_linux | — | Upgrade php-bcmathUpgrade php8.4-fpmUpgrade php8.4-dbgUpgrade php8.4-debugsourceUpgrade php-enchantUpgrade php8.4-opcache-debuginfoUpgrade libzip-debugsourceUpgrade php8.4-soapUpgrade php8.4-dba-debuginfoUpgrade php8.4-xml-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-dbaUpgrade php-cli-debuginfoUpgrade php-soapUpgrade php8.4-bcmathUpgrade php-xmlrpcUpgrade php-pecl-xdebug3-debugsourceUpgrade php8.4-process-debuginfoUpgrade php-debugsourceUpgrade php8.4-gd-debuginfoUpgrade php-odbc-debuginfoUpgrade php8.4-develUpgrade php-mysqlndUpgrade libzipUpgrade php-gdUpgrade php-pdo-debuginfoUpgrade php-gmpUpgrade phpUpgrade php8.4-odbcUpgrade php8.4-opcacheUpgrade php8.4-dbaUpgrade php8.4-pdoUpgrade php-pecl-apcu-develUpgrade php8.4Upgrade php-embeddedUpgrade php-ldap-debuginfoUpgrade php-pecl-zipUpgrade php-processUpgrade php-pecl-redis6-debugsourceUpgrade php8.4-cliUpgrade php-mbstringUpgrade php-pecl-apcu-debuginfoUpgrade php-pecl-rrdUpgrade php-pecl-rrd-debugsourceUpgrade php8.4-pdo-debuginfoUpgrade php-gd-debuginfoUpgrade php-gmp-debuginfoUpgrade php-jsonUpgrade php8.4-commonUpgrade php8.4-processUpgrade php8.4-mbstring-debuginfoUpgrade php-embedded-debuginfoUpgrade php8.4-dbg-debuginfoUpgrade php8.4-intlUpgrade php-dbg-debuginfoUpgrade php-intl-debuginfoUpgrade php-opcacheUpgrade libzip-tools-debuginfoUpgrade php-pdoUpgrade php-pecl-rrd-debuginfoUpgrade php-process-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-snmp-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-fpm-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-apcuUpgrade php-ldapUpgrade php-cliUpgrade php8.4-mysqlndUpgrade php-pecl-xdebug-debugsourceUpgrade php-dbgUpgrade php-develUpgrade php-pecl-xdebugUpgrade php8.4-ldap-debuginfoUpgrade php8.4-ldapUpgrade php-intlUpgrade php8.4-intl-debuginfoUpgrade php8.4-ffi-debuginfoUpgrade php8.4-snmpUpgrade php-common-debuginfoUpgrade php8.4-embedded-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-ffiUpgrade php8.4-xmlUpgrade php-pecl-redis6-debuginfoUpgrade php-commonUpgrade php8.4-odbc-debuginfoUpgrade php8.4-enchantUpgrade php-pgsqlUpgrade php-bcmath-debuginfoUpgrade libzip-develUpgrade php8.4-pgsql-debuginfoUpgrade php8.4-cli-debuginfoUpgrade php-soap-debuginfoUpgrade php-xml-debuginfoUpgrade php8.4-embeddedUpgrade libzip-debuginfoUpgrade php8.4-soap-debuginfoUpgrade php8.4-snmp-debuginfoUpgrade php8.4-mbstringUpgrade php8.4-gdUpgrade libzip-toolsUpgrade php-snmpUpgrade php8.4-debuginfoUpgrade php8.4-enchant-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pecl-xdebug3Upgrade php-opcache-debuginfoUpgrade php8.4-ffiUpgrade php8.4-bcmath-debuginfoUpgrade php-xmlUpgrade php-ffi-debuginfoUpgrade php-enchant-debuginfoUpgrade php-debuginfoUpgrade php8.4-gmpUpgrade php-mysqlnd-debuginfoUpgrade php-dba-debuginfoUpgrade php8.4-pgsqlUpgrade php8.4-gmp-debuginfoUpgrade php-pecl-xdebug3-debuginfoUpgrade php-json-debuginfoUpgrade php-fpmUpgrade php8.4-mysqlnd-debuginfoUpgrade php8.4-fpm-debuginfoUpgrade php8.4-common-debuginfoUpgrade php-odbcUpgrade php-mbstring-debuginfo | Jun 2, 2026 | Jun 1, 2026 |
| Ubuntu | — | Upgrade php8.5Upgrade php8.4Upgrade php8.3 | May 28, 2026 | May 10, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub