blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2024-11233

HIGH 8.2 CVSS 3.1
Published
November 24, 2024
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@php.net
Weakness
CWE-122, CWE-787
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Description

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas.

Affected products and versions

  • PHP — From 8.1.0 (including) to 8.1.31 (excluding)
  • PHP — From 8.2.0 (including) to 8.2.26 (excluding)
  • PHP — From 8.3.0 (including) to 8.3.14 (excluding)

References

  • github.com https://github.com/php/php-src/security/advisories/GHSA-r977-prxv-hc43 Exploit, Vendor Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html
  • security.netapp.com https://security.netapp.com/advisory/ntap-20241220-0008/
  • nvd.nist.gov Official NVD record