Moderate Vulnerability in PHP Package: Security Update Required
Summary
RLSA-2025:23309: Moderate: php:8.3 security update. Affects php versions < 0:8.3.26-1.module+el9.7.0+40049+21bbec6b. Fixed in 0:8.3.26-1.module+el9.7.0+40049+21bbec6b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is an HTML-embedded scripting language widely utilized for web development, particularly with the Apache HTTP Server. It enables developers to create dynamic web pages and applications. The recent security update addresses multiple vulnerabilities within PHP, specifically affecting versions prior to 8.3.26. These vulnerabilities could lead to severe security risks if not addressed promptly.
Vulnerability Detail
The vulnerabilities identified in PHP include: 1) The pgsql extension does not check for errors during escaping (CVE-2025-1735), which could allow for SQL injection attacks. 2) A NULL Pointer Dereference in the PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491), potentially leading to application crashes. 3) The PHP Hostname Null Character Vulnerability (CVE-2025-1220), which could be exploited to bypass security checks. These vulnerabilities can compromise the integrity and availability of applications using PHP.
How To Fix
Minimum fixed version
0:8.3.26-1.module+el9.7.0+40049+21bbec6b
This is the first release that contains the fix.
sudo dnf update phpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable the affected extensions or implement input validation to mitigate the risk of exploitation until the update is applied. However, this is not a permanent solution and should be followed by an update.
Conclusion
The vulnerabilities in PHP pose significant risks to applications relying on this scripting language. It is crucial to update to the latest patched version to ensure the security and integrity of your applications. Regular monitoring and updates are essential to mitigate such vulnerabilities effectively.
See every vulnerability recorded for php →
FAQ
The CVSS score for this vulnerability is 5.9, indicating a moderate level of risk.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If immediate updates are not possible, consider disabling the affected extensions or implementing strict input validation as a temporary workaround.
Detailed information about the vulnerabilities can be found on the CVE pages linked in the references section of the vulnerability report.
Continuing to use the affected version poses security risks. It is highly recommended to update to the patched version as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for php.
