Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-7260: Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9. CVE-2026-17544: Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9. CVE-2026-17543: Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
Fixed packages 56
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | php8.5 | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-bcmath | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-bcmath-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-cli | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-cli-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-common | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-common-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-dba | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-dba-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-dbg | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-dbg-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-debugsource | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-devel | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-embedded | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-embedded-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-enchant | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-enchant-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-ffi | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-ffi-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-fpm | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-fpm-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-gd | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-gd-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-gmp | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-gmp-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-intl | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-intl-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-ldap | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-ldap-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-mbstring | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-mbstring-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-modphp | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-modphp-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-mysqlnd | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-mysqlnd-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-odbc | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-odbc-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-pdo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-pdo-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-pgsql | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-pgsql-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-process | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-process-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-snmp | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-snmp-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-soap | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-soap-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-sodium | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-sodium-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-tidy | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-tidy-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-xml | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-xml-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-zip | 0:8.5.9-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.5-zip-debuginfo | 0:8.5.9-1.amzn2023.0.1 |
Vulnerabilities 3
-
High 8.1CVE-2026-17543 Public exploit
SQL injection in ext-pgsql via E'...' backslash breakout
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
-
High 8.1CVE-2026-17544 Public exploit
Out-of-bounds write in bccomp() via crafted operand and scale
Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.
-
Medium 5.4
Stack overflow in phar with circular symlinks
Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.