Critical Vulnerability in PHP 8.4: CVE-2026-12184
Summary
DEBIAN-CVE-2026-12184: ... Affects php8.4 versions < 8.4.21-1~deb13u1. Fixed in 8.4.21-1~deb13u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP 8.4 is a widely used server-side scripting language designed for web development but also used as a general-purpose programming language. It is known for its ease of use, flexibility, and extensive community support. However, like any software, it is susceptible to vulnerabilities that can compromise security and functionality. The vulnerability identified as CVE-2026-12184 affects PHP 8.4 in Debian distributions, specifically versions prior to 8.4.21-1~deb13u1 for Debian 13 (Trixie) and 8.4.21-1 for Debian 14 (Forky).
Vulnerability Detail
CVE-2026-12184 is a critical vulnerability that arises from improper handling of certain inputs in PHP 8.4, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The vulnerability originates from flaws in the parsing of user inputs, which can be exploited if not properly sanitized. This can lead to severe consequences, including unauthorized access to sensitive data and disruption of service.
How To Fix
Minimum fixed version
8.4.21-1~deb13u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php8.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the affected PHP application or disable certain features until the update is applied. However, this is not a long-term solution and should only be used until the patch is implemented.
Conclusion
CVE-2026-12184 is a significant vulnerability affecting PHP 8.4 in Debian distributions, necessitating immediate attention to prevent potential exploitation. Users are urged to update to the latest patched versions to safeguard their applications.
See every vulnerability recorded for php8.4 →
FAQ
CVE-2026-12184 is a critical vulnerability in PHP 8.4 that can lead to arbitrary code execution or denial of service due to improper input handling.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
Failing to address this vulnerability can result in unauthorized access to sensitive data, potential data loss, and service disruptions.
Yes, the patched versions are 8.4.21-1~deb13u1 for Debian 13 and 8.4.21-1 for Debian 14.
If immediate updates are not possible, consider restricting access to the affected application or disabling vulnerable features until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for php8.4.
