swoole vulnerabilities

Products

• swoole 3
• swoole php framework 1
• swoole-src 1

Latest swoole CVEs

Newest publication first

1. CVE-2026-24814 A integer overflow in swoole/swoole-src

   Published 2026-01-27

   Critical·CVSS 10.0 EPSS 0.30%

   Integer Overflow or Wraparound vulnerability in swoole swoole-src (thirdparty/hiredis modules). This vulnerability is associated with program files sds.C. This issue affects swoole-src: before 6.0.2.

2. CVE-2020-24275 A HTTP response header injection vulnerability in Swoole v4.5.2 allows attackers to execute arbitrary code via supplying a crafted URL.

   Published 2023-07-20

   Medium·CVSS 6.5 EPSS 0.77%

   A HTTP response header injection vulnerability in Swoole v4.5.2 allows attackers to execute arbitrary code via supplying a crafted URL.

3. CVE-2021-43676 Path manipulation in matyhtf/framework

   Published 2021-12-03

   Critical·CVSS 9.8 EPSS 1.4% PoC

   matyhtf framework v3.0.5 is affected by a path manipulation vulnerability in Smarty.class.php.

4. CVE-2019-15518 Swoole before 4.2.13 allows directory traversal in swPort_http_static_handler.

   Published 2019-08-23

   Medium·CVSS 5.3 EPSS 2.0%

   Swoole before 4.2.13 allows directory traversal in swPort_http_static_handler.

5. CVE-2018-15503 The unpack implementation in Swoole version 4.0.4 lacks correct size checks in the deserialization process. An attacker can craft a serialized object to exploit this vulnerability and cause a SEGV.

   Published 2018-08-18

   High·CVSS 7.5 EPSS 2.3%

   The unpack implementation in Swoole version 4.0.4 lacks correct size checks in the deserialization process. An attacker can craft a serialized object to exploit this vulnerability and cause a SEGV.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.