CVE-2026-7258
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, functions like urldecode() pass signed char to ctype functions (e.g., isxdigit()). On systems with default signed char and optimized table-lookup ctype functions (e.g., NetBSD), this can lead to array access with negative offset, potentially causing denial of service.
Risk Assessment
A remote attacker can cause denial of service by sending a specially crafted request exploiting the vulnerable function.
Recommendation
Update PHP to version 8.2.31, 8.3.31, 8.4.21, 8.5.6 or later.
Other vulnerabilities in PHP
See all- CVE-2026-13081Unknown
This CVE has been rejected. Reason: Red Hat is not the CNA for PHP. CVE was reserved in error; the appropriate CNA should assign CVE IDs for these vulnerabilities.
- CVE-2026-13047Unknown
This CVE has been rejected. Reason: Red Hat is not the CNA for PHP. CVE was reserved in error; the appropriate CNA should assign CVE IDs for these vulnerabilities.
- CVE-2017-12934High
PHP versions 7.0.x before 7.0.21 and 7.1.x before 7.1.7 are prone to a heap use after free while unserializing untrusted data. This issue is related to the zval_get_type function in Zend/zend_types.h.
- CVE-2017-11628High
In PHP versions before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function could lead to denial of service or potentially allow executing code. This issue is relevant for PHP applications that accept untrusted input for the parse_ini_string or parse_ini_file function.
- CVE-2017-11142High
In PHP versions before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a denial of service attack by injecting long form variables, leading to excessive CPU consumption.
- CVE-2016-5399High
The bzread function in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted bz2 archive.
- CVE-2017-6441High
The _zval_get_long_func_ex function in PHP 7.1.2 has a vulnerability that allows attackers to cause a denial of service through crafted use of 'declare(ticks=' in a PHP script, leading to a NULL pointer dereference and application crash.
- CVE-2017-7272High
PHP versions up to 7.1.11 enable potential SSRF attacks in applications that accept a hostname argument for fsockopen or pfsockopen, expecting the port number to be constrained. Due to the recognition of :port syntax, fsockopen will use the port number specified in the hostname argument instead of the port number in the second argument of the function.
- CVE-2016-10161High
The object_common1 function in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via crafted serialized data that is mishandled in a finish_nested_data call.
- CVE-2016-10158High
The exif_convert_any_to_int function in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1.
Original NVD description (English source)
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.