blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2024-8929

MEDIUM 5.8 CVSS 3.1
Published
November 22, 2024
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@php.net
Weakness
CWE-125, CWE-200
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Description

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.

Affected products and versions

  • PHP — From 8.1.0 (including) to 8.1.31 (excluding)
  • PHP — From 8.2.0 (including) to 8.2.26 (excluding)
  • PHP — From 8.3.0 (including) to 8.3.14 (excluding)

References

  • github.com https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678 Exploit, Vendor Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html
  • security.netapp.com https://security.netapp.com/advisory/ntap-20250110-0008/ Third Party Advisory
  • nvd.nist.gov Official NVD record