Skip to content
OpenAdvisories
High RHSA-2026:1409 6 CVEs

Red Hat Security Advisory: php:8.2 security update

Published Jan 28, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 64

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream apcu-panel 0:5.1.23-1.module+el9.4.0+20748+b46899d2
Red Hat · RHEL 9 enterprise_linux:9::appstream php 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-bcmath 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-bcmath-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-cli 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-cli-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-common 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-common-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-dba 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-dba-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-dbg 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-dbg-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-debugsource 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-devel 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-embedded 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-embedded-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-enchant 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-enchant-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-ffi 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-ffi-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-fpm 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-fpm-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-gd 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-gd-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-gmp 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-gmp-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-intl 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-intl-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-ldap 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-ldap-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-mbstring 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-mbstring-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-mysqlnd 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-mysqlnd-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-odbc 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-odbc-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-opcache 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-opcache-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pdo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pdo-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-apcu 0:5.1.23-1.module+el9.4.0+20748+b46899d2
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-apcu-debuginfo 0:5.1.23-1.module+el9.4.0+20748+b46899d2
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-apcu-debugsource 0:5.1.23-1.module+el9.4.0+20748+b46899d2
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-apcu-devel 0:5.1.23-1.module+el9.4.0+20748+b46899d2
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-rrd 0:2.0.3-4.module+el9.4.0+20748+b46899d2
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-rrd-debuginfo 0:2.0.3-4.module+el9.4.0+20748+b46899d2
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-rrd-debugsource 0:2.0.3-4.module+el9.4.0+20748+b46899d2
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-xdebug3 0:3.2.2-2.module+el9.4.0+20796+bd4564df
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-xdebug3-debuginfo 0:3.2.2-2.module+el9.4.0+20796+bd4564df
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-xdebug3-debugsource 0:3.2.2-2.module+el9.4.0+20796+bd4564df
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-zip 0:1.22.3-1.module+el9.4.0+20748+b46899d2
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-zip-debuginfo 0:1.22.3-1.module+el9.4.0+20748+b46899d2
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pecl-zip-debugsource 0:1.22.3-1.module+el9.4.0+20748+b46899d2
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pgsql 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-pgsql-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-process 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-process-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-snmp 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-snmp-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-soap 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-soap-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-xml 0:8.2.30-1.module+el9.7.0+23849+7b831f17
Red Hat · RHEL 9 enterprise_linux:9::appstream php-xml-debuginfo 0:8.2.30-1.module+el9.7.0+23849+7b831f17

Vulnerabilities 6

  • High 8.2
    CVE-2025-14180

    NULL Pointer Dereference in PDO quoting

    In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared sta…

    PHP Group PHP php php8.1 Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2025-14178

    Heap buffer overflow in array_merge()

    In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to a…

    PHP Group PHP php7.2 php7.4 Debian Ubuntu Azure Linux Alpine
  • Medium 6.3
    CVE-2025-14177 Public exploit

    Information Leak of Memory in getimagesize

    In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode …

    PHP Group PHP php php8.2 Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2025-1735

    pgsql extension does not check for errors during escaping

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as inv…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2025-6491

    NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine
  • Low 3.7
    CVE-2025-1220

    Null byte termination in hostnames

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() t…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2378689
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2378690
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2379792
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2425625
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2425626
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2425627
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1409.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-1220
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-1220
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-1220
  • article
    https://github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r
  • report
    https://access.redhat.com/security/cve/CVE-2025-1735
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-1735
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-1735
  • article
    https://github.com/php/php-src/security/advisories/GHSA-hrwm-9436-5mv3
  • report
    https://access.redhat.com/security/cve/CVE-2025-6491
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-6491
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-6491
  • article
    https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x
  • report
    https://access.redhat.com/security/cve/CVE-2025-14177
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-14177
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-14177
  • article
    https://github.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7
  • report
    https://access.redhat.com/security/cve/CVE-2025-14178
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-14178
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-14178
  • article
    https://github.com/php/php-src/security/advisories/GHSA-h96m-rvf9-jgm2
  • report
    https://access.redhat.com/security/cve/CVE-2025-14180
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-14180
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-14180
  • article
    https://github.com/php/php-src/security/advisories/GHSA-8xr5-qppj-gvwj