Repository navigation
Security: php/php-src
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location headerGHSA-7875-c8px-7q5f published
Sep 24, 2026 by bukkaModerate -
RCE via OOM corruptionGHSA-w8hw-w9fx-j79w published
Oct 21, 2026 by bukkaCritical -
RCE via stale global stateGHSA-6wmf-4rv5-p3rp published
Oct 21, 2026 by bukkaCritical -
IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)GHSA-62xp-839h-2637 published
Sep 24, 2026 by bukkaModerate -
ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODEDGHSA-ch8v-r6jh-4vvr published
Sep 24, 2026 by bukkaLow -
ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PADGHSA-7jrw-539f-x6vr published
Jul 2, 2026 by bukkaModerate -
Cross-origin credential leak in HTTP stream wrapper redirectsGHSA-fpwc-w8rq-cr92 published
Sep 24, 2026 by bukkaModerate -
SOAP: Unbounded Recursion in Server-Side cleanup_xml_nodeGHSA-rgrp-mwpx-f6rm published
Sep 24, 2026 by bukkaHigh -
SQL injection in ext-pgsql via E'...' backslash breakoutGHSA-7qpv-r5mr-78m4 published
Jul 30, 2026 by iluuu1994High -
Out-of-bounds write in bccomp() via crafted operand and scaleGHSA-x692-q9x7-8c3f published
Jul 30, 2026 by iluuu1994High