blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2026-14355

MEDIUM 5.3 CVSS 3.1
Published
July 3, 2026
Last modified
July 8, 2026
NVD status
Analyzed
Reported by
security@php.net
Weakness
CWE-122
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Description

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

Affected products and versions

  • PHP — From 8.2.0 (including) to 8.2.32 (excluding)
  • PHP — From 8.3.0 (including) to 8.3.32 (excluding)
  • PHP — From 8.4.0 (including) to 8.4.23 (excluding)
  • PHP — From 8.5.0 (including) to 8.5.8 (excluding)

References

  • github.com https://github.com/php/php-src/security/advisories/GHSA-7jrw-539f-x6vr Vendor Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2026/07/msg00010.html Mailing List, Third Party Advisory
  • nvd.nist.gov Official NVD record