Critical Security Update for PHP 8.4: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:22649: Important: php8.4 security update. Affects php8.4 versions < 8.4.21-1.el10_2. Fixed in 8.4.21-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP 8.4 is a widely used HTML-embedded scripting language that simplifies the creation of dynamically generated web pages. It offers built-in database integration for various database management systems, making it a popular choice for developers. However, recent vulnerabilities have been identified that could compromise the security of applications using this version.
Vulnerability Detail
The vulnerabilities in PHP 8.4 include a Denial of Service (DoS) due to improper handling of signed characters in ctype functions, a Cross-Site Scripting (XSS) vulnerability in PHP-FPM due to improper URL sanitation, a NULL pointer dereference in the SOAP apache:Map decoder, a signed integer overflow in the metaphone() function, a denial of service via DOMNode::C14N(), and a global buffer over-read in mb_convert_encoding() with attacker-supplied encoding. These vulnerabilities can lead to severe security risks, including application crashes, data exposure, and unauthorized access.
How To Fix
Minimum fixed version
8.4.21-1.el10_2
This is the first release that contains the fix.
sudo dnf update php8.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling the affected features or limiting access to PHP-FPM until the update can be applied. Ensure that input validation is implemented to mitigate the risk of XSS attacks.
Conclusion
In summary, PHP 8.4 has several critical vulnerabilities that require immediate attention. Updating to the latest patched version is essential to safeguard applications against potential attacks. Utilizing tools like Vulert can further enhance security by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for php8.4 →
FAQ
The main vulnerabilities include Denial of Service, Cross-Site Scripting, NULL pointer dereference, signed integer overflow, and global buffer over-read.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The recommended action is to update PHP 8.4 and its related packages to the patched version 8.4.21-1.el10_2.
Yes, temporarily disable affected features or limit access to PHP-FPM until the update can be applied.
Vulert monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, providing real-time insights into potential security risks.
Related vulnerabilities
Recent vulnerabilities recorded for php8.4.
