Critical Denial of Service Vulnerability in PHP 8.4 - CVE-2026-14355
Summary
RLSA-2026:49914: Low: php8.4 security, bug fix, and enhancement update. Affects php8.4 versions < 0:8.4.23-1.el10_2. Fixed in 0:8.4.23-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development. It allows developers to create dynamic web pages and offers built-in database integration for various database management systems. PHP is known for its ease of use and flexibility, making it a popular choice for both small and large-scale web applications. However, vulnerabilities can arise, such as the one identified in the PHP OpenSSL extension, which can lead to significant security risks.
Vulnerability Detail
The vulnerability identified as CVE-2026-14355 is a Denial of Service (DoS) issue stemming from a buffer allocation flaw in the AES-WRAP-PAD function of the PHP OpenSSL extension. This flaw can be exploited by an attacker to cause the application to become unresponsive, leading to service disruption. The potential ramifications include downtime for web applications that rely on PHP, loss of availability, and possible data loss if the application cannot recover from the attack.
How To Fix
Minimum fixed version
0:8.4.23-1.el10_2
This is the first release that contains the fix.
sudo dnf update php8.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the PHP OpenSSL extension if it is not critical for your application. This can be done by commenting out the line in the php.ini configuration file that loads the OpenSSL extension: 'extension=openssl.so'. However, this is not a long-term solution and should only be used until the package can be updated.
Conclusion
The CVE-2026-14355 vulnerability poses a significant risk to PHP applications using the OpenSSL extension, potentially leading to Denial of Service attacks. It is crucial for developers and system administrators to update their PHP installations to version 8.4.23 or later to mitigate this risk. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain application security.
See every vulnerability recorded for php8.4 →
FAQ
CVE-2026-14355 is a vulnerability in the PHP OpenSSL extension that can lead to a Denial of Service due to a buffer allocation flaw.
If exploited, this vulnerability can cause your PHP application to become unresponsive, leading to service downtime and potential data loss.
The vulnerability affects PHP 8.4 versions prior to 8.4.23.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without signup.
The CVSS score for this vulnerability is 5.6, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for php8.4.
