almalinux/php-ldap

Vulnerabilities (104)

• CVE-2026-109619HigKEVOct 21, 2026
  affected < 8.3.36-1.el10_2fixed 8.3.36-1.el10_2

  PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may r

• CVE-2026-109618CriKEVOct 21, 2026
  affected < 8.3.36-1.el10_2fixed 8.3.36-1.el10_2

  PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cle

• CVE-2026-92842MedSep 25, 2026
  affected < 7.4.33-8.module_el8.10.0+4321+cf5fd4bbfixed 7.4.33-8.module_el8.10.0+4321+cf5fd4bb

  The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at th

• CVE-2026-91768MedSep 25, 2026
  affected < 7.4.33-8.module_el8.10.0+4321+cf5fd4bbfixed 7.4.33-8.module_el8.10.0+4321+cf5fd4bb

  The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passe

• CVE-2026-91769MedSep 25, 2026
  affected < 7.4.33-8.module_el8.10.0+4321+cf5fd4bbfixed 7.4.33-8.module_el8.10.0+4321+cf5fd4bb

  PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-m

• CVE-2026-91767MedSep 25, 2026
  affected < 7.4.33-8.module_el8.10.0+4321+cf5fd4bbfixed 7.4.33-8.module_el8.10.0+4321+cf5fd4bb

  php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a

• CVE-2026-91766MedSep 25, 2026
  affected < 7.4.33-8.module_el8.10.0+4321+cf5fd4bbfixed 7.4.33-8.module_el8.10.0+4321+cf5fd4bb

  When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redi

• CVE-2026-91765HigSep 25, 2026
  affected < 8.3.36-1.el10_2fixed 8.3.36-1.el10_2

  cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unb

• CVE-2026-6103MedSep 25, 2026
  affected < 7.4.33-8.module_el8.10.0+4321+cf5fd4bbfixed 7.4.33-8.module_el8.10.0+4321+cf5fd4bb

  phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interpr

• CVE-2025-1218LowSep 25, 2026
  affected < 7.4.33-8.module_el8.10.0+4321+cf5fd4bbfixed 7.4.33-8.module_el8.10.0+4321+cf5fd4bb

  The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefine

• CVE-2025-14181MedSep 25, 2026
  affected < 7.4.33-8.module_el8.10.0+4321+cf5fd4bbfixed 7.4.33-8.module_el8.10.0+4321+cf5fd4bb

  The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller t

• CVE-2026-93682MedSep 25, 2026
  affected < 7.4.33-8.module_el8.10.0+4321+cf5fd4bbfixed 7.4.33-8.module_el8.10.0+4321+cf5fd4bb

  When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a

• CVE-2026-7260MedJul 30, 2026
  affected < 8.3.33-1.module_el9.8.0+297+88e7f1bffixed 8.3.33-1.module_el9.8.0+297+88e7f1bf

  Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

• CVE-2026-17543CriJul 30, 2026
  affected < 8.3.33-1.module_el9.8.0+297+88e7f1bffixed 8.3.33-1.module_el9.8.0+297+88e7f1bf

  Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

• CVE-2026-14355MedJul 3, 2026
  affected < 8.2.32-1.module_el9.8.0+284+2e0ccc92fixed 8.2.32-1.module_el9.8.0+284+2e0ccc92

  In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the pla

• CVE-2026-7568HigMay 10, 2026
  affected < 8.3.31-2.module_el9.8.0+255+747189f2fixed 8.3.31-2.module_el9.8.0+255+747189f2

  In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 byte

• CVE-2026-7262HigMay 10, 2026
  affected < 8.3.31-2.module_el9.8.0+255+747189f2fixed 8.3.31-2.module_el9.8.0+255+747189f2

  In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element.  This leads to dereference

• CVE-2026-7261CriMay 10, 2026
  affected < 8.0.30-6.el9_8fixed 8.0.30-6.el9_8

  In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in a

• CVE-2026-7259MedMay 10, 2026
  affected < 8.3.31-1.el10_2fixed 8.3.31-1.el10_2

  In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to  a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is explo

• CVE-2026-7258HigMay 10, 2026
  affected < 8.3.31-2.module_el9.8.0+255+747189f2fixed 8.3.31-2.module_el9.8.0+255+747189f2

  In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions