SB2026092449 - Multiple vulnerabilities in PHP

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026092449

SB2026092449 - Multiple vulnerabilities in PHP

Published: September 24, 2026

Security Bulletin ID SB2026092449
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 83% Low 17%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Out-of-bounds read (CVE-ID: CVE-2026-93682)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose limited information.

The vulnerability exists due to an out-of-bounds read in the HTTP stream wrapper redirect handling when processing a redirect response with an empty Location header. A remote attacker can operate a server that a PHP application fetches from, or redirect a request to such a server, to disclose limited information.

At most one bit, indicating whether the out-of-bounds byte is zero, is observable through the request path received by the server.


2) Incorrect Comparison (CVE-ID: CVE-2026-91768)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass the FastCGI access control and access the endpoint.

The vulnerability exists due to an incorrect comparison in fcgi_is_allowed() in main/fastcgi.c when validating IPv6 client addresses against listen.allowed_clients. A remote attacker can send a FastCGI request from an IPv6 address sharing the first 96 bits with an allowed address to bypass the FastCGI access control and access the endpoint.

Only deployments using FastCGI over IPv6 TCP and relying on listen.allowed_clients as a security boundary are affected.


3) Use of Uninitialized Variable (CVE-ID: N/A)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause inconsistent sanitization of 0xFF bytes.

The vulnerability exists due to use of uninitialized memory in the ext/filter FILTER_SANITIZE_ENCODED lookup table when processing input containing a 0xFF byte. A remote attacker can supply crafted input containing a 0xFF byte to cause inconsistent sanitization of 0xFF bytes.

All other input bytes are handled deterministically.


4) Insufficiently protected credentials (CVE-ID: CVE-2026-91766)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose credentials.

The vulnerability exists due to improper credential forwarding in the HTTP stream wrapper when following a cross-origin redirect. A remote attacker can control a redirect target to disclose credentials.

The issue affects user-supplied Authorization, Cookie, and Proxy-Authorization headers, including redirects from HTTPS to HTTP.


5) Uncontrolled Recursion (CVE-ID: CVE-2026-91765)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the SOAP XML parser's cleanup_xml_node() function when handling a SOAP request containing deeply nested XML elements. A remote attacker can send a specially crafted SOAP request to cause a denial of service.


6) Heap-based buffer overflow (CVE-ID: CVE-2026-91767)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to a heap-based buffer overflow in php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c when verifying a TLS server certificate wildcard name against a shorter hostname. A remote attacker can present a crafted TLS server certificate with a wildcard common name to disclose sensitive information.

The crafted certificate must be trusted by the certificate authority in use or be presented by a server controlled by the attacker.


Remediation

Install update from vendor's website.

References