Skip to content
OpenAdvisories
Medium RHSA-2025:23309 3 CVEs

Red Hat Security Advisory: php:8.3 security update

Published Dec 19, 2025 · Updated Jun 30, 2026

Ecosystem: Red Hat

Fixed packages 67

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream apcu-panel 0:5.1.23-1.module+el9.6.0+22647+1741ae35
Red Hat · RHEL 9 enterprise_linux:9::appstream php 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-bcmath 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-bcmath-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-cli 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-cli-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-common 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-common-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-dba 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-dba-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-dbg 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-dbg-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-debugsource 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-devel 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-embedded 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-embedded-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-enchant 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-enchant-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-ffi 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-ffi-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-fpm 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-fpm-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-gd 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-gd-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-gmp 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-gmp-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-intl 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-intl-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-ldap 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-ldap-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-mbstring 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-mbstring-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-mysqlnd 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-mysqlnd-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-odbc 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-odbc-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-opcache 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-opcache-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pdo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pdo-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-apcu 0:5.1.23-1.module+el9.6.0+22647+1741ae35
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-apcu-debuginfo 0:5.1.23-1.module+el9.6.0+22647+1741ae35
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-apcu-debugsource 0:5.1.23-1.module+el9.6.0+22647+1741ae35
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-apcu-devel 0:5.1.23-1.module+el9.6.0+22647+1741ae35
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-redis6 0:6.1.0-2.module+el9.6.0+22647+1741ae35
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-redis6-debuginfo 0:6.1.0-2.module+el9.6.0+22647+1741ae35
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-redis6-debugsource 0:6.1.0-2.module+el9.6.0+22647+1741ae35
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-rrd 0:2.0.3-4.module+el9.6.0+22647+1741ae35
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-rrd-debuginfo 0:2.0.3-4.module+el9.6.0+22647+1741ae35
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-rrd-debugsource 0:2.0.3-4.module+el9.6.0+22647+1741ae35
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-xdebug3 0:3.3.1-1.module+el9.6.0+22647+1741ae35
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-xdebug3-debuginfo 0:3.3.1-1.module+el9.6.0+22647+1741ae35
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-xdebug3-debugsource 0:3.3.1-1.module+el9.6.0+22647+1741ae35
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-zip 0:1.22.3-1.module+el9.6.0+22647+1741ae35
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-zip-debuginfo 0:1.22.3-1.module+el9.6.0+22647+1741ae35
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-zip-debugsource 0:1.22.3-1.module+el9.6.0+22647+1741ae35
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pgsql 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pgsql-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-process 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-process-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-snmp 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-snmp-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-soap 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-soap-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-xml 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3
Red Hat · RHEL 9 enterprise_linux:9::appstream php-xml-debuginfo 0:8.3.26-1.module+el9.7.0+23549+c13c2ce3

Vulnerabilities 3

  • Medium 5.9
    CVE-2025-1735

    pgsql extension does not check for errors during escaping

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as inv…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2025-6491

    NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine
  • Low 3.7
    CVE-2025-1220

    Null byte termination in hostnames

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() t…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2378689
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2378690
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2379792
  • article
    https://issues.redhat.com/browse/RHEL-116530
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23309.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-1220
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-1220
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-1220
  • article
    https://github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r
  • report
    https://access.redhat.com/security/cve/CVE-2025-1735
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-1735
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-1735
  • article
    https://github.com/php/php-src/security/advisories/GHSA-hrwm-9436-5mv3
  • report
    https://access.redhat.com/security/cve/CVE-2025-6491
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-6491
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-6491
  • article
    https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x