PHP Patches Three Flaws Enabling SQL Injection, Memory Corruption, and Server Crashes
PHP has released maintenance updates to fix three vulnerabilities in its extensions, including flaws that could lead to SQL injection, memory corruption, and denial-of-service attacks.
PHP has released critical maintenance updates to address three security vulnerabilities affecting its optional extensions: ext-pgsql, ext-bcmath, and ext-phar. These flaws, if exploited, could allow attackers to inject SQL commands, corrupt memory, or cause denial-of-service conditions, impacting web applications that rely on these components.
The most severe vulnerability, tracked as CVE-2026-17543, resides in the PostgreSQL extension (ext-pgsql). It affects convenience functions like pg_insert(), pg_update(), pg_select(), and pg_delete(). The issue arises from improper escaping of user-supplied input within the php_pgsql_convert() function. When PostgreSQL's standard_conforming_strings setting is enabled, backslashes are not safely escaped, potentially allowing attackers to inject malicious SQL commands and manipulate database data.
PHP has patched this SQL injection vulnerability by implementing non-escaping string constants when processing these parameters, ensuring that user input is handled more securely. This fix is crucial for applications that use these PostgreSQL helper functions, especially when dealing with untrusted input.
Another high-severity flaw, CVE-2026-17544, impacts the BCMath extension's bccomp() function. This vulnerability can lead to memory corruption through out-of-bounds writes when processing attacker-controlled numeric strings with a specific scale value. The bug occurs in bc_str2num() where, after truncating fractional digits and removing trailing zeros, the allocated buffer size is reduced but the pointer defining the end of the copied data is not updated. This can result in more data being copied than the buffer can hold, potentially corrupting stack or heap memory and leading to application crashes or more severe exploitation pathways.
The BCMath extension has been updated to correctly adjust the fractional endpoint after zero truncation, ensuring that the copied data aligns with the allocated buffer size and preventing out-of-bounds writes.
The third vulnerability, CVE-2026-7260, affects the Phar extension and can lead to denial-of-service by causing PHP processes to crash. This flaw stems from the phar_get_link_source() function, which recursively follows symbolic links within Phar archives without proper checks for recursion depth or circular references. A specially crafted Phar archive containing circular symbolic links can trigger infinite recursion, resulting in a segmentation fault and a moderate-severity DoS condition (CVSS 6.5).
This Phar extension vulnerability requires a user or application to process a malicious archive. However, it poses a risk to services that automatically inspect or extract uploaded files. The fix involves implementing safeguards against unbounded recursion in symbolic link processing within Phar archives.
Users are strongly advised to update their PHP installations to the latest maintenance versions: 8.2.33, 8.3.33, 8.4.24, or 8.5.9. Administrators should also review applications that utilize the affected PostgreSQL helper functions, perform BCMath operations with external values, or process Phar/tar archives to mitigate potential risks.