Denial of Service Vulnerability in PHP OpenSSL Extension - Low Severity
Summary
ALSA-2026:47750: Low: php:7.4 security, bug fix, and enhancement update. Affects apcu-panel versions < 5.1.18-1.module_el8.6.0+2750+78feabcb. Fixed in 5.1.18-1.module_el8.6.0+2750+78feabcb. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development. It is embedded within HTML and is commonly utilized alongside the Apache HTTP Server. The PHP OpenSSL extension provides secure communication over networks by implementing SSL and TLS protocols. However, a recent vulnerability has been identified that affects the buffer allocation in the AES-WRAP-PAD functionality, potentially leading to denial of service.
Vulnerability Detail
The vulnerability arises from a flaw in the buffer allocation process within the PHP OpenSSL extension, specifically in the AES-WRAP-PAD implementation. This flaw can be exploited to cause a denial of service, where the affected service becomes unresponsive or crashes. The vulnerability is tracked under CVE-2026-14355, and it poses a risk to applications relying on the PHP OpenSSL extension for secure communications.
How To Fix
Minimum fixed version
5.1.18-1.module_el8.6.0+2750+78feabcb
This is the first release that contains the fix.
sudo dnf update apcu-panelTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the PHP OpenSSL extension if it is not critical for your application. This can be done by commenting out the extension in your php.ini file: 'extension=openssl.so'. However, this may affect the functionality of applications relying on secure communications.
Conclusion
In summary, the vulnerability in the PHP OpenSSL extension poses a risk of denial of service due to a buffer allocation flaw. It is crucial to update to the patched version to mitigate this risk. Temporary workarounds are available, but they may affect application functionality.
See every vulnerability recorded for apcu-panel →
FAQ
CVE-2026-14355 is the identifier for a vulnerability in the PHP OpenSSL extension that can lead to denial of service due to a buffer allocation flaw.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability may result in your application becoming unresponsive, leading to potential downtime and loss of service for users.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If immediate updates are not possible, consider implementing the provided workaround by disabling the OpenSSL extension temporarily.
Related vulnerabilities
Recent vulnerabilities recorded for apcu-panel.
