Critical PHP Security Update: Heap Overflow and Information Disclosure Vulnerabilities
Summary
RLSA-2026:1628: Important: php security update. Affects php versions < 0:8.3.29-1.el10_1. Fixed in 0:8.3.29-1.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language that is especially suited for web development. It is embedded within HTML and is commonly used in conjunction with the Apache HTTP Server. PHP allows developers to create dynamic web pages and applications. However, vulnerabilities in PHP can lead to severe security risks, including data breaches and service disruptions.
Vulnerability Detail
The vulnerabilities in PHP include a heap-based buffer overflow in the array_merge() function, which can lead to memory corruption and potential code execution. Additionally, there is an information disclosure vulnerability via the getimagesize() function when processing multi-chunk images, which could expose sensitive data. Lastly, a denial of service vulnerability exists due to an invalid character sequence in PDO PostgreSQL prepared statements, which can crash the application. These vulnerabilities stem from improper handling of data and can have significant ramifications for applications relying on PHP.
How To Fix
Minimum fixed version
0:8.3.29-1.el10_1
This is the first release that contains the fix.
sudo dnf update phpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the affected functions or implementing input validation to mitigate the risk of exploitation until the package can be updated. For example, you can limit the types of images processed by the getimagesize() function to prevent information disclosure.
Conclusion
The recent PHP security update addresses critical vulnerabilities that could lead to severe consequences for applications using this scripting language. It is essential to update to the patched version promptly and consider implementing workarounds to mitigate risks in the interim.
See every vulnerability recorded for php →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
The vulnerabilities can lead to memory corruption, information disclosure, and denial of service, which may compromise the integrity and availability of your applications.
It is not recommended to use the affected version as it poses significant security risks. It is best to update to the patched version as soon as possible.
For more details, refer to the CVE pages associated with the vulnerabilities: CVE-2025-14177, CVE-2025-14178, and CVE-2025-14180.
References
Related vulnerabilities
Recent vulnerabilities recorded for php.
