Skip to content

Product

redhat/php vulnerabilities

39 published CVES affecting redhat/php, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
39
Critical
6
High
10
Medium
20
Low
3
Unscored
0
CISA KEV
2

Latest redhat/php CVEs

Newest publication first · page 1 of 2

  1. CVE-2026-109619 RCE via stale global state

    Published
    CriticalCVSS 9.2 EPSS 100.0% CISA KEV added 2026-10-26 Exploited in the wild

    PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may r...

  2. CVE-2026-109618 RCE via OOM corruption

    Published
    CriticalCVSS 9.2 EPSS 100.0% CISA KEV added 2026-10-26 Exploited in the wild

    PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cle...

  3. CVE-2026-95101 NGINX ngx_http_v3_module vulnerability

    Published
    MediumCVSS 6.9 EPSS 0.35%

    Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remo...

  4. CVE-2026-97629 NGINX ngx_http_ssl_module vulnerability

    Published
    HighCVSS 8.3

    Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL session...

  5. CVE-2026-15176 NGINX ngx_http_core_module vulnerability

    Published
    CriticalCVSS 9.2

    A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $reques...

  8. CVE-2026-91769 TLS Hostname Verification Falls Back to CN After SAN Mismatch

    Published
    MediumCVSS 4.3

    PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-m...

  10. CVE-2025-1218 Various packet overreads in mysqlnd_writeprotocol.c

    Published
    LowCVSS 3.4

    The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefine...

  11. CVE-2026-91766 Cross-origin credential leak in HTTP stream wrapper redirects

    Published
    MediumCVSS 5.9

    When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redi...

  12. CVE-2026-91765 SOAP: Unbounded Recursion in Server-Side cleanup_xml_node

    Published
    HighCVSS 7.5

    cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unb...

  13. CVE-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing

    Published
    MediumCVSS 6.5

    The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller t...

  17. CVE-2026-90439 NGINX ngx_http_v3_module vulnerability

    Published
    MediumCVSS 6.9

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-de...

  18. CVE-2026-58081 Heap based buffer overflow in iconv(3)

    Published
    CriticalCVSS 9.8

    Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. An application that uses iconv(3) to convert untrusted input to or from one of the affected encodings may be vuln...

  19. CVE-2026-7260 Stack overflow in phar with circular symlinks

    Published
    MediumCVSS 5.4

    Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

  23. CVE-2026-60005 NGINX ngx_http_slice_module vulnerability

    Published
    HighCVSS 8.8

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory...

  24. CVE-2026-56434 NGINX ngx_http_ssi_module vulnerability

    Published
    HighCVSS 8.3

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-...

  25. CVE-2026-42533 NGINX Map directive and Regex matching vulnerability

    Published
    CriticalCVSS 9.2

    A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cac...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.