Critical Denial of Service Vulnerability in PHP 8.4 Packages
Summary
ALSA-2026:49914: Low: php8.4 security, bug fix, and enhancement update. Affects php8.4 versions < 8.4.23-1.el10_2. Fixed in 8.4.23-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development. It allows developers to create dynamic web pages and offers built-in database integration for various database management systems. PHP is commonly utilized as a replacement for CGI scripts, making it a vital tool for web developers. The PHP 8.4 series includes several packages, such as php8.4, php8.4-cli, and php8.4-fpm, which are essential for running PHP applications. However, a recent vulnerability has been identified that affects these packages, posing a significant risk to applications relying on them.
Vulnerability Detail
The vulnerability stems from a buffer allocation flaw in the PHP OpenSSL extension, specifically in the AES-WRAP-PAD functionality. This flaw can lead to a Denial of Service (DoS) condition, where an attacker can exploit the vulnerability to crash the PHP service, rendering web applications inoperable. The vulnerability is tracked under CVE-2026-14355 and affects multiple PHP 8.4 packages, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
8.4.23-1.el10_2
This is the first release that contains the fix.
sudo dnf update php8.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the PHP service or implement firewall rules to restrict traffic until the update can be applied. However, this is not a permanent solution and should only be used until the vulnerability is patched.
Conclusion
The identified vulnerability in PHP 8.4 packages poses a significant risk to web applications, potentially leading to Denial of Service conditions. It is crucial for users to update their PHP installations to the patched version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for php8.4 →
FAQ
CVE-2026-14355 is a vulnerability in the PHP OpenSSL extension that can lead to a Denial of Service condition due to a buffer allocation flaw.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to address this vulnerability can result in service outages, where your web applications may become unresponsive or crash, affecting user experience and potentially leading to data loss.
Yes, you should upgrade to version 8.4.23-1.el10_2 or later to ensure that the vulnerability is patched.
If immediate updates are not possible, consider implementing access restrictions to your PHP service as a temporary measure until you can apply the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for php8.4.
