Critical SQL Injection and Denial of Service Vulnerabilities in PHP 8.2
Summary
RLSA-2026:57574: Important: php:8.2 security, bug fix, and enhancement update. Affects libzip across 3 version ranges.
< 0:1.7.3-1.module+el8.10.0+1596+477f03f8
< 0:1.7.3-1.module+el8.10.0+1911+f499711e
< 0:1.7.3-1.module+el8.10.0+1605+02e07af7
Fixed in 0:1.7.3-1.module+el8.10.0+1596+477f03f8, 0:1.7.3-1.module+el8.10.0+1911+f499711e or 0:1.7.3-1.module+el8.10.0+1605+02e07af7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is an HTML-embedded scripting language widely utilized for web development, particularly in conjunction with the Apache HTTP Server. It allows developers to create dynamic web pages and applications. The recent vulnerabilities identified in PHP 8.2 highlight significant security flaws that could potentially compromise applications relying on this version.
Vulnerability Detail
The vulnerabilities stem from two critical issues: first, a SQL injection vulnerability in the ext-pgsql extension due to improper backslash escaping (CVE-2026-17543), which could allow attackers to manipulate SQL queries and gain unauthorized access to databases. Second, a Denial of Service vulnerability (CVE-2026-7260) exists due to circular symbolic links in phar archives, which could lead to application crashes or unavailability. Both vulnerabilities pose serious risks to the integrity and availability of applications using PHP 8.2.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update libzip-
< 0:1.7.3-1.module+el8.10.0+1596+477f03f80:1.7.3-1.module+el8.10.0+1596+477f03f8 -
< 0:1.7.3-1.module+el8.10.0+1605+02e07af70:1.7.3-1.module+el8.10.0+1605+02e07af7 -
< 0:1.7.3-1.module+el8.10.0+1911+f499711e0:1.7.3-1.module+el8.10.0+1911+f499711e
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can mitigate the risk of SQL injection by implementing input validation and sanitization in their applications. For the Denial of Service vulnerability, avoid using phar archives with circular symbolic links until the update is applied.
Conclusion
The vulnerabilities in PHP 8.2 present significant risks that could compromise the security and availability of applications. It is crucial for developers and system administrators to update to the latest patched version and implement best practices to mitigate these risks.
See every vulnerability recorded for libzip →
FAQ
The CVSS score for this vulnerability is 7.4, indicating a high severity level.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By uploading your manifest file, you can check for vulnerabilities without requiring access to the code.
The SQL injection vulnerability could lead to unauthorized database access, while the Denial of Service vulnerability could cause application downtime, affecting user experience and service availability.
Yes, upgrading to PHP 8.2.33 or later will ensure that these vulnerabilities are patched.
Implement input validation and sanitization to protect against SQL injection and avoid using phar archives with circular symbolic links until you can apply the update.
References
Related vulnerabilities
Recent vulnerabilities recorded for libzip.
